In 2018, the General Data Protection Regulation (GDPR) set a mark for privacy rules and laws in Europe. But four years on, organisations continue to face many challenges when it comes to complying with the law. The situation is at times far from static and clear, for instance when it comes to international data transfers.