Legal data sharing under GDPR creates complex compliance obligations that extend far beyond basic data protection measures. When law firms, corporate legal departments, and their business partners exchange sensitive information across jurisdictions, they must navigate intricate requirements for lawful basis establishment, data minimisation, and cross-border transfer safeguards. The stakes are substantial.