Given the recent ruling in regards to the EU-US Privacy Shield and GDPR  would it still be possible to implement a global system with regional data sources? Specifically can you request a user email and process it in a location that may be outside EU with the explicit purpose of determining whether that the user should use a EU tenant or not for the rest of their session?
I have a software-as-a-service product with a global footprint. Most data is not classified as PII and so is stored in all regions. For data deemed PII I would like to store it in the appropriate region only. So when a user logs in to their account, the idea was to have them enter their email address, look up their region in a mapping table of a hashed value of the email address to a region, available globally and use that information to send all PII related browser requests to the regional servers only.
Follow up example:
Let’s say I still have a global software-as-a-service company. I set up two different data centres, one in EU, and one outside. When new clients are onboarded the select their region. How do I handle authentication in this case? One option is to give the clients different urls depending on region e.g. us.my-saas.com/login and eu.my-saas.com/login but that would not be an ideal user experience. Under GDPR, is there no way of having something like login.my-saas.com and depending on metadata associated with their profile or username automatically determine where to send them?