(in reply to krehl) And in that specific case you should probably have a DPA ready. Big issue with anything Google-related (and probably CloudFlare) is that they may transfer the data outside of the EU[0].

[0] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...