EU data residency: where your data sits and who can reach it

GDPR does not require personal data to be stored in the EU. It requires a lawful basis for every transfer outside the EU and security that fits the risk, wherever the data sits. EU data residency requirements come from elsewhere: from sector rules, public tenders, contracts with large customers and the worry that a US provider can be ordered to hand data over under US law. For many European buyers, hosting in the EU has become a condition of the deal rather than a legal duty.

This guide separates the three questions that get mixed up: where the data is stored, who operates the systems, and whose law can reach it. It covers what GDPR and other EU laws actually ask, what the US CLOUD Act changes, how the AWS regions and the AWS European Sovereign Cloud compare with European providers, and how to decide for a website, a portal or a SaaS product.

What GDPR asks, and what it does not

Chapter V of the GDPR governs transfers of personal data to countries outside the European Economic Area. A transfer is allowed when one of these applies:

• the country has an adequacy decision from the European Commission, as the United Kingdom, Switzerland, Japan and, for certified companies, the United States under the Data Privacy Framework do;
• appropriate safeguards are in place, usually the standard contractual clauses of 2021, with a transfer impact assessment;
• a narrow derogation in article 49 applies, such as explicit consent for a one-off transfer.

Nothing in the GDPR says data must stay in the EU. Article 32 asks for security appropriate to the risk, article 28 for a processing agreement with every processor, and article 48 says that a court or authority order from a non-EU country is only recognised in the EU when it rests on an international agreement, such as a mutual legal assistance treaty. That last article is the hinge of the residency debate. What a US company needs in place to receive EU data is in GDPR for US companies, and the UK position is in UK GDPR vs EU GDPR.

Some EU and national rules do go further for specific sectors: health data in several member states, public sector cloud rules such as France's SecNumCloud qualification for sensitive government data, and banking supervisors' outsourcing guidelines. A general business website or SaaS rarely falls under them, but its customers might, and their requirements then flow down into your contract.

The CLOUD Act and why buyers ask

The US Clarifying Lawful Overseas Use of Data Act of 2018 allows US authorities, with a warrant, to require a US provider to produce data in its possession, custody or control, even if that data is stored outside the United States. A server in Frankfurt run by a US company is therefore not out of reach of a US warrant in principle. The provider can challenge an order that would make it break the law of the country where the data is stored, and the major providers publish how often they receive such requests.

That is the tension European buyers point at: GDPR article 48 says such an order is not recognised in the EU without a treaty, while the CLOUD Act says the US provider must comply. Encryption with keys the provider cannot access reduces what could be handed over; it does not change who the provider answers to.

Regions and providers in Europe

The big US clouds run regions across Europe, and AWS opened a separate sovereign cloud in January 2026. Not every European region sits in the EU: London and Zurich are outside it, though both countries have adequacy decisions.

The AWS European Sovereign Cloud launched with more than 90 services, a subset of the standard catalogue, and Amazon says it will invest more than 7.8 billion euros in it in Germany. Whether it is sovereign enough is a question each buyer answers for itself; it is a step beyond a region, and still owned by a US company.

Moving between providers will get easier. The EU Data Act has applied since 12 September 2025, and from 12 January 2027 cloud providers may no longer charge for switching to another provider; see Data Act cloud switching.

Choosing for your website, portal or SaaS

The right answer depends on what the data is and who is asking:

• Choose an EU region of a large cloud ifyour data is ordinary customer and account data, your buyers ask for EU storage, and you want the full range of services. This covers most business websites, client portals and B2B SaaS.
• Choose the AWS European Sovereign Cloud or a comparable offer ifyour buyers ask for EU operation and EU-resident staff, and you want to stay on the same technology.
• Choose an EU-owned provider ifa tender or a customer excludes US-owned providers, or you handle data where any foreign access would be unacceptable to your customers.
• Keep a US region only ifyour users and customers are mostly in the US, you have a valid transfer route for the EU data, and no EU customer asks otherwise.

Backups, email, logs: the rest of the stack

Whatever you choose, the rest of the stack has to follow: backups, logs, email, analytics, error tracking and support tools all hold personal data too. A residency promise in the contract is broken as easily by a US error-tracking service as by the main database.

Write all of this into a short data map: per type of data, the system, the region, the provider and its role. It is the first thing a serious buyer's security questionnaire asks for, and the basis for your processing agreements; see data processing agreement.