GDPR data residency is not about keeping all data in the EU. It is about lawful processing, appropriate safeguards, and demonstrable compliance. This guide covers what GDPR actually requires for data residency, how to implement technical controls for data localization, how to structure Data Processing Agreements (DPAs) with cloud providers, and how to verify compliance continuously.
According to the European Data Protection Board's 2026 annual report, 43% of GDPR fines relate to insufficient technical measures for data protection. Fines totaled 2.1 billion euros in 2025, with the average fine increasing 38% year-over-year. Cloud hosting decisions are directly relevant to GDPR compliance.
---
What GDPR Actually Requires
GDPR does not mandate that all data stays in the EU. It requires that personal data transferred outside the EU/EEA has adequate protection. The practical options are:
| Option | Complexity | Recommendation |
| Keep data in EU | Low | Best default for most companies |
| Standard Contractual Clauses (SCCs) | Medium | For specific non-EU services |
| Adequacy decision countries | Low | UK, Japan, South Korea, etc. |
| Binding Corporate Rules | High | Large enterprises only |
Personal Data Categories
Not all data is personal data. Classify your data to determine what needs EU residency.
| Data Type | Personal Data? | Residency Required | Examples |
| User accounts | Yes | Yes | Name, email, IP address |
| Payment data | Yes | Yes | Card details, billing address |
| Usage analytics (with user ID) | Yes | Yes | Feature usage, session data |
| Usage analytics (anonymized) | No | No | Aggregate metrics, counts |
| Application logs (with IP) | Yes | Yes | Request logs with user context |
| Application logs (no PII) | No | No | Error logs, performance metrics |
| Infrastructure metrics | No | No | CPU usage, memory, disk |
---
Technical Architecture for Data Residency
<h1>data-residency-architecture.yaml</h1>
eu_infrastructure:
region: eu-west-1 # Frankfurt, Amsterdam, or Paris
services:
primary_database:
type: managed_postgresql
location: eu-west-1
encryption: aes-256
contains: all_personal_data
object_storage:
type: s3_compatible
location: eu-west-1
encryption: aes-256
contains: user_uploads, documents
application_servers:
type: vps
location: eu-west-1
count: 2
redis_cache:
type: managed_redis
location: eu-west-1
contains: session_data, cached_user_data
non_eu_allowed:
cdn_edge_cache:
type: cdn
data: static_assets_only # No personal data cached at edge
monitoring:
type: prometheus_grafana
location: eu-west-1 # Keep monitoring in EU too
data: infrastructure_metrics # No PII in metrics
error_tracking:
type: sentry
location: eu # Use Sentry EU data center
scrubbing: enabled # Remove PII from error reports
---
Data Processing Agreement Essentials
Every cloud provider processing personal data on your behalf needs a DPA. The DPA is required under GDPR Article 28.
DPA Checklist
- [ ] Specifies the types of personal data processed
- [ ] Defines the purpose and duration of processing
- [ ] Lists the data subjects covered
- [ ] Requires processor to act only on documented instructions
- [ ] Requires confidentiality obligations for staff
- [ ] Specifies technical and organizational security measures
- [ ] Addresses sub-processor management (notification and approval)
- [ ] Includes data breach notification obligations (72 hours)
- [ ] Provides audit rights for the controller
- [ ] Specifies data return/deletion upon termination
- [ ] Includes cross-border transfer mechanisms (SCCs if applicable)
Key DPA Clauses
Data Processing Locations:
The Processor shall process Personal Data exclusively within
the European Economic Area (EEA) unless explicitly authorized
in writing by the Controller. The specific processing locations are:
<ul><li>Primary: [Provider EU Data Center, e.g., Frankfurt, DE]</li>
<li>Backup: [Provider EU Backup Location, e.g., Amsterdam, NL]</li>
</ul>
Sub-Processors:
The Processor shall not engage any sub-processor without prior
written authorization from the Controller. The Processor shall
provide the Controller with a list of current sub-processors
and notify of any intended changes at least 30 days in advance.
Data Breach Notification:
The Processor shall notify the Controller without undue delay,
and in any event within 24 hours, after becoming aware of a
personal data breach.
Arxentra provides a standard DPA for all customers. See Documentation for the current DPA template and data processing details.
---
Technical Controls Implementation
Database-Level Controls
-- Encryption at rest verification
SHOW ssl; -- Should return "on"
-- Row-level security for multi-tenant isolation
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON users
USING (tenant_id = current_setting('app.current_tenant')::int);
-- Audit logging for personal data access
CREATE EXTENSION pgaudit;
ALTER SYSTEM SET pgaudit.log = 'read, write';
ALTER SYSTEM SET pgaudit.log_catalog = off;
Application-Level Controls
<h1>Data residency enforcement in application code</h1>
ALLOWED_REGIONS = ["eu-west-1", "eu-central-1", "eu-north-1"]
def validate_data_residency(storage_region: str) -> bool:
"""Ensure personal data is stored in approved EU regions."""
if storage_region not in ALLOWED_REGIONS:
raise DataResidencyViolation(
f"Region {storage_region} is not approved for personal data. "
f"Allowed regions: {ALLOWED_REGIONS}"
)
return True
<h1>Data minimization: only collect what you need</h1>
class UserProfile(BaseModel):
email: str # Required for account
name: str # Required for display
# Do NOT collect: date_of_birth, phone (unless needed)
# Do NOT store: raw IP addresses (hash or truncate)
---
Compliance Verification
Verify compliance continuously, not just during audits.
| Check | Frequency | Method | Automated |
| Data location audit | Monthly | Query provider API for resource locations | Yes |
| Encryption verification | Weekly | SSL scan + database config check | Yes |
| Access log review | Weekly | Audit log analysis | Partially |
| Sub-processor review | Quarterly | Review provider sub-processor list | No |
| DPA validity check | Annually | Legal review | No |
| Data retention enforcement | Monthly | Database query for expired data | Yes |
| Breach response drill | Quarterly | Simulated breach exercise | No |
---
Data Subject Rights Implementation
GDPR grants data subjects specific rights that your infrastructure must support.
| Right | Infrastructure Requirement | Implementation |
| Access (Art. 15) | Export all user data | API endpoint: GET /api/user/data-export |
| Rectification (Art. 16) | Update personal data | Standard update endpoints |
| Erasure (Art. 17) | Delete all user data | Cascading delete across all systems |
| Portability (Art. 20) | Export in machine-readable format | JSON/CSV export endpoint |
| Restriction (Art. 18) | Flag data as restricted | Database status column |
<h1>Data export endpoint (Right of Access + Portability)</h1>
@app.get("/api/user/data-export")
async def export_user_data(user_id: int):",
data = {
"profile": await db.get_user_profile(user_id),
"services": await db.get_user_services(user_id),
"billing": await db.get_user_billing(user_id),
"activity_log": await db.get_user_activity(user_id),
"exported_at": datetime.utcnow().isoformat(),
}
return JSONResponse(content=data, headers={
"Content-Disposition": "attachment; filename=user-data-export.json"
})
For EU hosting options, see Pricing. For data handling policies, visit Contact.
---
Frequently Asked Questions
Do I need EU servers if my company is not in the EU?
If you have EU users or customers, GDPR applies regardless of where your company is located. If you process personal data of EU residents, you must comply with GDPR data protection requirements, which is most easily achieved by hosting personal data in the EU.
Can I use a US-based cloud provider for GDPR compliance?
Yes, if the provider has EU data centers and you configure your infrastructure to use them exclusively. You also need a DPA and, if data might transit through non-EU infrastructure, Standard Contractual Clauses. Arxentra offers EU-based infrastructure that simplifies compliance.
What happens if I accidentally store personal data outside the EU?
Document the incident, assess the risk, and remediate immediately. If it constitutes a personal data breach (unauthorized access was possible), you may need to notify your supervisory authority within 72 hours. Implement technical controls to prevent recurrence.
How do I handle backups across regions?
Keep backups in the same region as the primary data. If you need geo-redundant backups, use another EU region (e.g., primary in Frankfurt, backup in Amsterdam). Never replicate personal data backups to non-EU regions.
Do anonymized analytics data need to stay in the EU?
No. Truly anonymized data is not personal data under GDPR and has no residency requirements. However, "anonymized" is a high bar: the data must be irreversibly anonymized so that no individual can be re-identified. Pseudonymized data (e.g., hashed user IDs) is still personal data and must comply with GDPR. See Documentation for anonymization guidance.