EU data hosting and GDPR: what to ask your host

EU data hosting means your data is stored and processed on servers physically located in EU countries. GDPR (the General Data Protection Regulation) does not generally require this, but it restricts transfers of personal data outside the EU and requires a contract with every provider that handles that data for you. Hosting in the EU simplifies both, without replacing them.

This guide is general information, not legal advice. Rules differ by country and sector, and your situation may have details that matter. Check with a qualified lawyer or your data protection officer before making decisions about compliance.

What GDPR is, in plain words

GDPR is the European Union’s law on personal data, meaning any information about an identifiable person: a name, an email address, a phone number, an order history, a chat transcript, an IP address. It applies not only to companies based in the EU but generally also to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. If you sell to European customers, it probably concerns you wherever you are based.

The law gives people rights over their data (to see it, correct it, ask for it to be deleted) and gives organisations duties: have a lawful reason for using data, collect only what you need, keep it secure, keep it no longer than necessary, and tell people what you do with it. Hosting is one part of meeting those duties, not the whole of it.

Data residency is not the same as legal access

Two ideas are often mixed up, and the difference matters when you choose a provider.

• Data residency is where your data physically sits: which country, which data centre.
• Legal access is which laws and authorities can compel whoever controls that data to hand it over.

A server in Frankfurt or Paris answers the first question. The second depends on who owns and operates the service. If a provider is headquartered or controlled outside the EU, laws of its home country may in some cases allow authorities there to demand data, even when the servers are in Europe. This is why European regulators and courts have paid so much attention to transfers, and why some organisations care about the nationality and ownership of their provider as well as the location of the data centre.

For many small businesses, an EU data centre run by a reputable provider with a solid contract is a reasonable level of protection. For health, finance, public sector or other sensitive data, the legal-access question deserves proper advice. Neither answer is the same for everyone, and no hosting choice makes the question disappear.

International transfers: the basics

GDPR treats personal data moving from the EU to another country as a regulated event. A transfer can happen by storing data abroad, but also by letting a provider in another country access it remotely, for example for support. Data can be transferred lawfully, but only on a recognised basis. The main ones are these.

• Adequacy decisions: the European Commission has decided that certain countries, or certain companies within them, offer a level of protection essentially equivalent to the EU’s. Data can flow to them without extra steps. The list changes, so check the current one rather than relying on memory.
• Standard contractual clauses (SCCs): model contract terms approved by the Commission that the exporter and importer sign. They are the most common tool when no adequacy decision applies, and they usually need to be paired with an assessment of whether the destination’s laws let the clauses work in practice.
• Binding corporate rules: internal rules for transfers inside a large corporate group, approved by regulators.
• Specific exceptions: narrow cases such as explicit consent for a single transfer. These are not meant for routine, repeated transfers.

The practical lesson: if your data stays in the EU and nobody outside the EU can access it, many of these questions largely disappear. If any part of your stack involves another country (a support team, an analytics tool, an AI service, a backup location), find out which mechanism covers it.

Controllers, processors and the data processing agreement

GDPR distinguishes two roles. The controller decides why and how personal data is used: usually that is you. A processor handles data on the controller’s behalf: your hosting provider, your email service, your CRM vendor.

When you use a processor, GDPR expects a written contract, usually called a data processing agreement or DPA. It generally covers what the processor may do with the data (only what you instruct), confidentiality, security measures, help with people’s requests, notification of data breaches, deletion or return of data at the end, and the use of sub-processors, which are the other companies your provider relies on. A provider that has no DPA to offer, or reluctantly says it will think about it, is a warning sign.

What to ask a hosting provider

Use this list when you compare providers, including us. Clear, specific answers are a good sign. Vague ones are not.

1. In which countries and data centres will my data be stored, including backups and replicas?
2. Can I choose the region, and is that choice contractually guaranteed rather than just a default?
3. Will anyone outside the EU have access to my data, for support, monitoring or operations? Under which transfer mechanism?
4. Who owns the company and where is it headquartered? Which laws could apply to it?
5. Do you offer a data processing agreement, and can I see it before I sign?
6. Which sub-processors do you use, where are they, and will you tell me before that list changes?
7. How are backups made, how often, where are they kept, and how quickly can you restore them?
8. What security measures are in place: encryption in transit and at rest, access controls, updates, logging?
9. What is your process if there is a data breach, and how fast will you tell me? Controllers generally have tight deadlines to report serious breaches to authorities.
10. What happens to my data when I leave: export format, deletion, and the time it takes?
11. What do you monitor, what happens when something goes down, and who is reachable?

Questions for your own side

Hosting is only one input. Before you pick a provider, answer a few questions about your own data.

• What personal data do we hold, and about whom (customers, staff, patients, candidates)?
• Is any of it in a sensitive category, such as health, or does a national or sector rule apply to it?
• Do our customers or contracts require data to stay in a given country or region?
• Which tools receive this data besides the host: email, analytics, payments, AI services?
• Who in our company is responsible for answering questions about it?

Some countries and sectors add their own requirements, such as health data rules or public procurement conditions that name a location. Those can be stricter than GDPR alone, which is another reason to involve counsel for sensitive cases.

AI services and where your data goes

AI adds a layer that people often overlook. When an assistant or AI agent reads a customer message or a document, that text may be sent to a model provider to produce an answer. Hosting your app in the EU does not by itself settle where that text is processed.

Ask which model provider is used, in which region the request is processed, whether your data is kept or used for training, and what contract covers it. Good providers can answer these questions in a few lines. If an AI project involves personal data, include the model provider in your list of processors and transfers.

When EU hosting is the wrong focus

Do not treat EU hosting as a compliance badge. A server in the EU with weak passwords, no backups and no contract is worse than a well-run service elsewhere with the right safeguards. If your users and customers are not in the EU, and you hold no EU personal data, GDPR may not apply to you at all, and other rules may matter more. And if the real problem is that you collect more data than you need, moving servers does not fix it.

Equally, location can matter for reasons beyond law: latency, since servers close to users respond faster, and trust, since some customers simply prefer their data to stay in their region. Those are legitimate reasons too, and they can point to a different choice.

A short checklist before you decide

• List the personal data you hold and where each part is stored today.
• Decide whether your customers or sector require a specific location.
• Get the provider’s data processing agreement and sub-processor list in writing.
• Confirm backups, access, and support are covered by the same location promise.
• Check how AI and other third-party tools handle the data.
• Test the exit: ask how you would export and delete everything.
• Ask a lawyer to review the setup if the data is sensitive or the stakes are high.

Next step

If you are planning a new project or moving an existing one, write down where your data must stay and why, then use the questions above to test each provider. Bitwire offers managed hosting with an EU option for sites, agents and custom tools. Tell us what you run and what rules apply, and we will give you an honest view of whether we are the right fit. If you are also weighing what to build, see custom software vs off-the-shelf.