How exactly does GDPR prevent you from complying with cybersecurity laws?

For instance, one of GDPR's 6 lawful bases for processing data is in order to comply with legal obligations.

If you're going to make strong claims like that, the onus really is on you to give specific examples.

I wonder is the GP is referring to the CLOUD Act, as it is true that US companies cannot be compliant with both the GDPR and the CLOUD Act, but it doesn't weaken the case for European tech sovereignty.