[OgsyedIE]

You need a consultation with a suitable security organisation and to have a C-level meeting to determine what category of messaging to your clients about this your legal team needs to draft. Treat it as if the worst-case scenario is true and all data that crosses the border will be cloned and forwarded to both competitors and phishing organizations, as if your employees are travelling to Myanmar.

The worst-case expectation for the U.S. is unlikely and emotionally fraught but as a CTO you have to consider your responsibilities. Not following advice like this doesn't just expose you to the one-in-a-million risk that the US will be that crazy, it exposes you to the one-in-ten risk that the Carney administration appeals to voters by introducing new laws in less than two years that make your company retroactively liable for "risking potential damages" to your clients, without a high burden of proof.