GDPR prohibits transfer of personal data absent assurances tha the data will be protected to the same or equivalent level it would in the EU. How might a service provider manage this when they are handling data from around the world with different rules for different countries