The next piece that concerned me was GDPR which required EU citizens data to be processed in the EU. This is similar to laws in China.
The US has also brought up various bills similar to this, and I wouldn't be surprised if in the future "citizen data" is supposedly not to leave a specific country.
This of course benefits huge corporations who can handle this infrastructure but is quite difficult for smaller companies.
That's wrong. It can be processed outside the EU, provided the country has laws providing adequate protections comparable (or better) than the GDPR.
Here more details: https://commission.europa.eu/law/law-topic/data-protection/i...