Isn’t this the case with all sovereign countries, though? You can never guarantee that a government won’t demand a company in that country to hand over data, that is what it means to be sovereign.

Generally speaking, we look at the legal system in the country and decide whether it is /legal/ for the state to do such a thing, and whether there are appropriate safeguards to prevent it from doing so. Yes, they could change the law - and at that point it would become illegal for companies in that country to do business in the EU.

Usually most countries are smart enough not to damage themselves economically by preventing their companies from selling to a large, reasonably rich union.

> Yes, they could change the law

They could also just not follow the law

Indeed. A country which fails to follow its own law on privacy would likely be considered a country which does not have appropriate law on privacy.