Thought for the day: if your business is collecting personal data sufficiently sensitive that your government doesn't want it to be processed or sold overseas, then you shouldn't be collecting it in the first place. (That aspect of your business should be totally illegal.)