Complying with the EU’s General Data Protection Regulation (GDPR) means different things for different groups. For many corporations, it means revamping consent and data handling processes and bringing on new staff. For law firms, means more client work.

But there is one group still deciding how the regulation will affect them: U.S. government agencies. Since the EU regulation applies to all worldwide entities that manage or process the personal data of EU citizens, in theory, some agencies, such as the U.S. State Department or the Department of Homeland Security, can fall under its purview. In reality, however, the situation is far more complex.