Data Residency

Data residency describes where data physically sits: the country or region of the data centres in which it is stored and processed. A provider that offers "EU data residency" is saying that its servers for that service are in the EU.

One service can touch several places. The main database may be in one country and the backups in another. Support staff may open records from a third. A subcontractor may run part of the service somewhere else. A useful answer about residency covers each of these.

No. The GDPR contains no rule that personal data must be stored in the EU. Its scope depends on who processes the data and whose data it is, not on where the servers are. Under Article 3(1) it covers processing in the context of an EU establishment "regardless of whether the processing takes place in the Union or not".

Inside the EU, location is not a data protection issue. Article 1(3) says that the free movement of personal data within the Union "shall be neither restricted nor prohibited" for data protection reasons.

What the regulation does control is the movement of personal data out of the EU. Chapter V, Articles 44 to 50, deals with transfers to third countries. Article 44 sets the principle: a transfer may take place only if the conditions of that chapter are met, so that the level of protection the GDPR guarantees "is not undermined". Keeping data in the EU is one way to stay outside those conditions. It is a choice, and the regulation does not impose it.

When one of three grounds in Chapter V applies. The first is an adequacy decision. Under Article 45 the European Commission can decide that a country, a territory or a sector ensures an adequate level of protection, and transfers there need no specific authorisation. The EU-US Data Privacy Framework is a decision of this kind and covers US organisations that have certified under it. Adequacy decisions are reviewed and can be amended, suspended or repealed (Article 45(3) and (5)), so check the Commission's current list.

The second is appropriate safeguards under Article 46. These include standard data protection clauses adopted by the Commission, which a firm will find in supplier contracts, and binding corporate rules for transfers inside a group of companies (Article 47).

The third is the list of derogations in Article 49, such as the explicit consent of the person concerned. They apply only where there is neither an adequacy decision nor appropriate safeguards.

Infringing Articles 44 to 49 can lead to a fine of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)(c)).

Not on its own. Residency says where the data is. It does not say which laws apply to the company that holds it. A provider that is subject to the law of a non-EU country may receive an order under that law to hand over data it controls, wherever the servers are. The US CLOUD Act is the example usually given: it concerns data held by providers subject to US jurisdiction, including data stored outside the United States.

The GDPR addresses such orders in Article 48. A judgment or decision of a third-country authority that requires a controller or processor to transfer or disclose personal data "may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty". A provider under two legal systems can therefore face a conflict. That is why clients ask who operates a service as well as where it is hosted.

Ask where the data is, who can reach it and what the contract says. The GDPR gives the firm, as controller, a basis for each question. A processor may transfer personal data to a third country only on the controller's documented instructions (Article 28(3)(a)), and may not engage another processor without the controller's written authorisation (Article 28(2)). The firm's own record of processing must list transfers to third countries (Article 30(1)(e)), and its privacy notice must say if it intends to make them (Article 13(1)(f)).

In practice that comes down to a short list. In which countries are the primary data and the backups stored? Which subcontractors process the data, and where? Can staff outside the EU open it? Which company signs the contract, and which country's law is that company subject to? What does the provider do if a foreign authority asks for the data?