Three terms come up again and again in hosting contracts and tenders: data residency, data sovereignty and data transfers. They are related but not the same, and knowing which one a customer is actually asking for saves a lot of back and forth.
Data residency: where the data physically is
Residency is about geography. A data residency requirement says personal data, or all data, must be stored in a particular place, such as "within the EU" or "in Germany". It is the easiest of the three to meet and to prove: you choose a server in that country and record its location.
Watch the wording. "In the EU" means the 27 member states. "In the EEA" adds Iceland, Liechtenstein and Norway. "In Europe" is vaguer and may or may not include the UK and Switzerland. When a contract is unclear, ask.
Data sovereignty: whose law applies
Sovereignty is about jurisdiction. Data stored in Frankfurt is subject to German and EU law, but if the company that operates the hardware is owned from another country, that country's laws may also apply to the company. The best-known example is the US CLOUD Act, which can require US companies to hand over data they control, wherever it is stored.
Full sovereignty requirements, typical in some public-sector and defence work, ask that the operator is owned and controlled inside the EU as well. Most commercial contracts do not go that far. They ask for residency, plus reasonable safeguards.
Data transfers: moving data across borders
Under the GDPR a "transfer" happens when personal data is sent to, or made accessible from, a country outside the EEA. Transfers need a legal mechanism: an adequacy decision for the destination country, standard contractual clauses, or one of a few narrower options.
The EU has adequacy decisions for a number of countries, including the UK and Switzerland. The EU-US Data Privacy Framework of 2023 covers transfers to US companies that sign up to it. Its two predecessors were struck down by the EU's Court of Justice, which is one reason many organisations prefer to keep data in the EU and avoid relying on transfers at all.
Putting it together
| The contract says | What it usually needs |
|---|---|
| Data must be stored in the EU | A server in an EU member state, and backups there too |
| Data must be stored in Germany | A server in Germany specifically |
| No transfers outside the EEA | EU or EEA hosting, and no remote access from outside the EEA |
| EU-sovereign provider | An operator owned and controlled in the EU, beyond server location |
Remote access counts
A server in Amsterdam with administrators logging in from outside the EEA may still involve a transfer, because data is made accessible from abroad. If residency matters, write down where your administrators and support staff work, and limit access accordingly.
This guide is general information, not legal advice.