"Clear" regulation is a fantasy. Every established boundary of regulation people enjoy in Western civilization was once and unclear, untested boundary that laws and courts had to cope with.

If folks find ambiguity in the GDPR, do NOT get into American Fintech. Here's a great question: what are the technical requirements mandated by the US government to become a bank?