Isn’t this the case with all sovereign countries, though? You can never guarantee that a government won’t demand a company in that country to hand over data, that is what it means to be sovereign.
Generally speaking, we look at the legal system in the country and decide whether it is /legal/ for the state to do such a thing, and whether there are appropriate safeguards to prevent it from doing so. Yes, they could change the law - and at that point it would become illegal for companies in that country to do business in the EU.
Usually most countries are smart enough not to damage themselves economically by preventing their companies from selling to a large, reasonably rich union.