Skip to content

Data residency

Data residency is where personal data is physically stored and processed, and under which jurisdiction's law it therefore sits. It matters because a transfer outside the European Economic Area is only permitted on specific conditions, and because many procurement and works council positions require data to stay within a named region.

Any transfer to a third country is allowed only on the conditions the regulation sets, so where the servers sit is a legal question before it is a technical one.

Why it matters when the plan changes

Employee assessment data is exactly the kind of processing a data protection officer will trace to a physical location. Article 44 of the General Data Protection Regulation permits a transfer to a third country only under the conditions the regulation sets, so the question is legal before it is technical. If any part of the chain, including a sub-processor's analytics or a model provider's endpoint, sits outside the region, the transfer needs a lawful mechanism and the notice has to say so. Most surprises here come from a component nobody thought of as processing.

The tension is between residency and capability. The strongest model or the cheapest infrastructure may sit outside the region, and choosing residency costs something in one of them. The honest position is to name where every processing step happens, including model calls, and let the controller decide, since Article 28's chain of written authorisation is where unnamed transfers otherwise hide.

In practice

A supplier confirms EU hosting and the procurement review passes. Six months later the data protection officer discovers that assessment text is sent to a model endpoint in another jurisdiction for scoring. The hosting statement was true and incomplete, and the transfer had no mechanism behind it. The remediation is a paper exercise the design phase would have avoided.

Evidence

What it cannot tell you

Data residency tells you where data sits and under which law, not whether the processing itself is lawful, proportionate or secure. A server inside the region can still process data unfairly, and a transfer mechanism can be technically valid while the underlying processing is not. Residency is a location fact, not a compliance verdict.

Questions

Any movement of personal data to a recipient outside the European Economic Area, including remote access and calls to a hosted service. Article 44 of the General Data Protection Regulation (2016) treats this as a transfer even if nothing is stored, which is the step most residency statements leave out.

An adequacy decision for the destination country, standard contractual clauses with a transfer assessment, binding corporate rules within a group, or one of the narrow derogations. Each carries documentation, and the choice has to be made before the transfer rather than justified afterwards.

Only if every processing step, including sub-processors and model providers, also sits in the region. Hosting describes where the main database lives. Article 28 of the General Data Protection Regulation (2016) requires written authorisation before a processor engages a further processor, which is where that trace through the chain begins.

Because it determines which law protects the employee and which authority they can complain to. A council will usually accept processing in the region under the regulation and resist processing under a legal regime it does not know, regardless of contractual assurances.

Step by step: where data is stored, where it is processed, which sub-processors touch it and where, and whether any model call leaves the region. A single sentence naming a hosting region is accurate and insufficient, and the gap between the two is where later disputes sit.