With cloud services, data is no longer stored in your own server room but in the provider's data centers, often spread across several locations. Data residency answers the question of which country or region these data centers are in. Many companies require storage within the EU, and some clients or industries also require storage within a specific country.
The GDPR does not generally require personal data to remain in the EU. However, transfers to third countries are only permitted under certain conditions, for example on the basis of an adequacy decision by the European Commission or standard contractual clauses.
How data residency is implemented
- Choice of region: On platforms such as Microsoft Azure, the company chooses the region when creating a resource. For many SaaS services, the country specified during setup determines the storage location.
- More than the storage location: Processing, backups, replication, support access, log data and subcontractors used must also be checked.
- Contractual commitments: Storage locations and subprocessors are set out in the data processing agreement (DPA) and its annexes. Some providers make additional commitments to process data within the EU.
- Technical supplement: Encryption with self-managed keys can increase control over the data.
Typical examples
- An organization in the healthcare or social sector requires client data to be stored exclusively in the EU.
- A tender requires proof of the data location of all cloud services used.
- Before using an AI service, the company checks where inputs are processed and whether they are used to train models.
What companies should keep in mind
- Classify data: Not all data needs the same requirements. Classifying it by protection needs makes decisions easier.
- Consider the entire data path: Besides the storage location, also check backups, support and subcontractors.
- Consider the provider's jurisdiction: Laws of the country of origin, such as the US CLOUD Act, may under certain circumstances oblige providers to hand over data, even if it is stored in Europe.
- Document: Record data locations in the record of processing activities and in the IT documentation.
How it differs
Data residency only describes the location. Data sovereignty goes further and means control over who can access data and which law it is subject to.
This entry is a general overview and does not replace legal advice.
View consulting