Does GDPR require data to be hosted in the EU?

No. GDPR does not impose a hosting location. It does regulate transfers of personal data outside the European Economic Area, which need an adequacy decision or appropriate safeguards such as standard contractual clauses. Hosting inside the EEA makes compliance much simpler, but it is not a general legal requirement.

Can a European company use a US cloud provider under GDPR?

Yes, if transfers are properly covered. US companies certified under the EU-US Data Privacy Framework benefit from the adequacy decision of 10 July 2023, which has been challenged in court but remains in force. Choosing European data centre regions and checking who can access data from outside Europe is still the prudent approach.

Is remote access from outside Europe a data transfer?

It can be. GDPR transfer rules are not only about where servers sit: if a provider or its support staff can access personal data from a country outside the EEA, that access may count as a transfer. Ask for the list of subprocessors and the countries they operate from, not just the data centre location.

What should I ask a hosting provider before signing?

Ask where data and backups are stored, which subprocessors can access them and from where, which law the parent company is subject to, what uptime is guaranteed, how restores are tested, and how you can export all your data and configuration if you leave. Get the answers written into the contract.

GDPRBusiness softwareMaintenanceChoosing a vendor

Where to host a business application in Europe

Published October 23, 20266 min read

No general rule forces a European company to host its business application in its own country, or even in Europe. GDPR does not set a hosting location, but it strictly regulates transfers of personal data outside the European Economic Area (EEA). Hosting inside the EEA therefore keeps compliance simple, while sector rules, such as health data hosting in France, can add stricter requirements.

This guide helps business owners and IT managers choose where to host an internal tool or client portal that handles personal data of people in the EU, and what to ask the provider. It stays general: for health, finance or public sector projects, have the choice validated by your data protection officer (DPO) or a lawyer.

What GDPR requires, and what it does not

Chapter V of Regulation (EU) 2016/679 allows transfers of personal data outside the EEA in two main situations:

the destination country has an adequacy decision from the European Commission (Article 45), recognising an equivalent level of protection;
otherwise, the exporter puts appropriate safeguards in place (Article 46), most often the Commission's standard contractual clauses, with extra technical measures such as encryption where needed.

A transfer is not only about storage. Remote access from a third country, for example by a provider's support team, can also be a transfer. So the question is not just where the servers are, but who can reach them and from where.

The United States. After the Court of Justice struck down the Privacy Shield in 2020 (the Schrems II ruling), the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. It covers US companies that have self-certified under the framework. The EU General Court dismissed an action to annul it on 3 September 2025 (case T-553/23), and an appeal is pending before the Court of Justice (case C-703/25 P). The framework is in force today, but its future depends on that appeal, which is a practical reason to prefer European data centre regions.

The United Kingdom. The UK applies its own UK GDPR, with its own transfer rules, supervised by the Information Commissioner's Office. If your users are in both the EU and the UK, check both sets of rules.

Three levels of requirement

Your data	Requirement	Reference
Routine business data	GDPR, controlled transfers	GDPR Chapter V
Health data hosted for others (France)	Certified HDS host	Public Health Code, L1111-8
Sensitive public sector data	Qualified cloud often required	National schemes, e.g. SecNumCloud

Most small and mid-sized business applications (scheduling, field service, quotes, client portals) sit at the first level. The choice of provider is open, as long as subprocessors and transfers are documented, as explained in our GDPR checklist for a business application.

Sector rules: the French example

Some countries add rules on top of GDPR for specific data. France is a good example because its rules are explicit.

Health data. Article L1111-8 of the French Public Health Code requires certification for anyone hosting personal health data collected during prevention, diagnosis, care or social and medical follow-up, on behalf of the people who produce it or of the patient. Certification is issued by an accredited body against a framework published by France's digital health agency, which also lists certified hosts. Version 2 of that framework, published in May 2024, added a requirement to store health data within the EEA and transparency duties about transfers and access from third countries. Previously certified hosts had until 16 May 2026 to move to the new version, according to the agency's transition briefing.

Sensitive public data. SecNumCloud is a qualification issued by ANSSI, France's cybersecurity agency, to cloud providers. It combines high security requirements with criteria meant to protect against non-European laws, covering for example the provider's headquarters, ownership and the absence of data access by non-European parties. It mainly concerns public bodies and operators handling sensitive data, and their suppliers.

If you serve health or public sector clients in another EU country, look for the equivalent national rules before choosing an architecture.

Public cloud, European host or your own server

Option	Strengths	Limits
Major cloud, EU region	Managed services, easy scaling	Non-EU parent company possible
European hosting provider	EU law and support	Sometimes fewer managed services
Server on your premises	Direct control	Backups, security and outages are yours

None of these is right in every case. A major cloud provider in a European region suits many applications, once you have reviewed its subprocessors and possible access from abroad. A European provider simplifies the legal analysis. An on-premises server shifts all operations onto you: patches, off-site backups, monitoring and hardware replacement.

Questions to ask before you sign

Where is the data? Countries and data centres, for production and for backups.
Who can access it, and from where? The list of subprocessors and the countries support works from.
Which law applies to the provider? The data centre location is not enough: the parent company's jurisdiction matters too.
What uptime is guaranteed? Service level, maintenance windows, time to restore.
Are backups tested? Frequency, retention period, and the date of the last restore that was actually tried.
How do you leave? A full export of data and configuration in a usable format. This is the subject of our exit plan for custom software.
Which certifications? ISO 27001, sector certifications where needed, with their exact scope.

Hosting does not end with picking a provider: updates, monitoring and backups are part of running the application, and the protective measures are covered in business application security: the essentials.

Where to start

Classify your data first: routine, personal, health, sensitive. That classification decides the hosting far more than technical preferences do. At LPR Studio, the question comes up during scoping, and the free prototype, presented in a video call within 5 working days, is the moment to discuss it before any price is set. With our SaaS and subscription models, hosting, maintenance and updates are included: see our offers.