EU data residency cloud choices: EU vs US providers
Hephaestus Technology7 min read
For most EU startups, the practical answer is to host personal data in an EU region and choose the provider by how much control you need over who can access it: an EU region of a US hyperscaler suits most products, a sovereign offering or an EU-owned provider suits public sector, health and other sensitive work, and US regions only make sense for data that is not personal or not sensitive. EU data residency reduces GDPR transfer issues but does not remove them, because remote access from outside the EU can still count as a transfer.
Key takeaways
- Storing data in an EU region is not the whole story: the EDPB treats remote access by a processor in a third country, such as support staff, as a transfer under Chapter V GDPR.
- An EU company subject to third-country law is not itself a transfer, but complying with a foreign authority's access request would be, according to EDPB Guidelines 05/2021.
- US providers now offer EU-focused options, such as Microsoft's EU Data Boundary and the AWS European Sovereign Cloud, generally available since 14 January 2026.
- EU-owned providers give the strongest jurisdictional story, usually with fewer managed services.
- From 12 January 2027 the EU Data Act bans switching charges, which lowers the cost of changing your mind later.
What does EU data residency actually mean?
EU data residency means your data is stored, and ideally processed, in data centres located in the EU or EEA. It is a technical and contractual commitment, not a legal category in the GDPR. The GDPR does not require personal data to stay in the EU; it requires that transfers outside the EEA meet the conditions in Chapter V, such as an adequacy decision or standard contractual clauses.
That distinction matters. The EDPB's Guidelines 05/2021, adopted in final form on 14 February 2023, define a transfer using three cumulative criteria: an exporter subject to the GDPR makes personal data available to a separate importer, and that importer is in a third country. Two examples from the guidelines are worth knowing:
- Remote access is a transfer. A processor in a third country that remotely accesses EU-stored data, for example for support, receives a transfer under Chapter V.
- Foreign law exposure is a risk, not automatically a transfer. Using an EU processor that is subject to third-country law is not a transfer, but if that processor complied with a third-country authority's access request, that disclosure would be. The EDPB says controllers should assess this before engaging the processor.
The second point is the heart of the "EU cloud vs US cloud" debate. US-headquartered providers are subject to US laws such as the CLOUD Act, enacted in March 2018 to speed access to electronic information held by US-based global providers.
What are the main options?
There are four realistic options for an EU startup, each trading convenience against control.
| Option | Where data sits | Legal exposure to US access | Managed services and AI tools | Typical fit |
|---|---|---|---|---|
| US hyperscaler, US region | United States | Direct; transfer needs DPF or SCCs | Widest | Non-personal data, global apps with no EU sensitivity |
| US hyperscaler, EU region | EU | Parent company subject to US law; support access may be a transfer | Very wide | Most B2B SaaS and consumer apps |
| US provider sovereign offering | EU, separate operations | Reduced by design, e.g. EU-resident staff and EU legal entities | Narrower at launch, growing | Regulated sectors, public sector suppliers |
| EU-headquartered provider | EU | Not subject to US jurisdiction in the same way | Narrower, especially for AI | Public sector, health, customers asking for EU sovereignty |
How do the US providers' EU options differ?
They differ mainly in how far operations, not just storage, are kept inside Europe.
EU regions of US clouds. All the large providers let you pick EU regions for storage and compute. Data at rest stays in the EU, but some metadata, support access and global services may involve the US. Transfers of that kind usually rely on the EU-US Data Privacy Framework or standard contractual clauses.
Microsoft EU Data Boundary. According to Microsoft's documentation, the EU Data Boundary is a commitment to store and process customer data and personal data for enterprise services such as Azure, Microsoft 365, Dynamics 365 and Power Platform within the EU and EFTA. Microsoft states that this is subject to "limited circumstances" where data will still be transferred outside the boundary, and personal data in system logs is pseudonymised.
AWS European Sovereign Cloud. AWS says its European Sovereign Cloud became generally available on 14 January 2026, with its first region in Brandenburg, Germany, running independently of other AWS regions. AWS states it is operated by EU residents located in the EU, managed through European legal entities under German law, with sovereign Local Zones planned in Belgium, the Netherlands and Portugal. These are the provider's own descriptions; assess them against your customers' requirements rather than treating "sovereign" as a guarantee.
When should you pick an EU-owned provider?
Pick an EU-headquartered provider when your customers or regulators care about jurisdiction, not just location. Common triggers are public sector tenders that ask for EU sovereignty, health or financial data, defence-adjacent work, and enterprise buyers whose security teams rule out US parents. The trade-off is usually a smaller catalogue of managed databases, analytics and AI services, which can mean more engineering time.
A hybrid is common: run the core product and personal data on an EU provider or a sovereign region, and use US services only for non-personal workloads such as build pipelines or anonymised analytics.
What does the Data Act change for cloud choices?
The EU Data Act makes switching easier, so your first choice is less of a lock-in. Under Article 29 of Regulation (EU) 2023/2854, providers may only charge reduced switching fees, capped at their direct costs, from 11 January 2024 to 12 January 2027, and from 12 January 2027 they may not charge switching fees at all. Article 32 also requires providers to take measures against third-country government access to non-personal data held in the EU where it would conflict with EU or national law.
The Commission's November 2025 digital omnibus proposal suggests targeted exemptions from some cloud-switching rules for SMEs and small mid-caps. That is a proposal, not law, so check its status before relying on it. For how the Data Act fits with GDPR, the AI Act and the Cyber Resilience Act, see our digital regulation map for EU startups.
How should an EU startup decide?
Decide with your data and your customers, not with headlines. A simple sequence:
- Classify your data. Separate personal, special category and non-personal data, and note any sector rules.
- Ask your target customers. Enterprise and public buyers often state hosting requirements in tenders; find out before you build.
- Default to an EU region for personal data unless there is a strong reason not to.
- Check support and sub-processor locations. Remote access from outside the EEA is a transfer, so confirm which transfer tool covers it.
- Design for portability. Containers, infrastructure as code and open data formats make a later move realistic.
- Document the decision in your records of processing and transfer assessments; our GDPR checklist for a new SaaS product shows where it fits.
This is general guidance, not legal advice. For regulated sectors, get specialist input before committing.
Frequently asked questions
Does GDPR require data to be stored in the EU?
No. The GDPR allows transfers outside the EEA if they meet Chapter V, for example under an adequacy decision or standard contractual clauses. EU hosting simply reduces how many transfers you need to justify.
Is hosting in an EU region of AWS, Azure or Google Cloud enough for GDPR?
It covers storage location, but you still need to check remote access, support and sub-processors outside the EEA, which the EDPB treats as transfers. Most providers cover these with the Data Privacy Framework or SCCs in their data processing terms.
What is a sovereign cloud?
There is no single legal definition. Providers use the term for offerings with EU-only operations, EU-resident staff and EU legal entities, such as the AWS European Sovereign Cloud launched in January 2026. Evaluate each offering's actual commitments.
Are EU cloud providers more expensive?
Not necessarily for raw compute and storage, but you may spend more engineering time if fewer managed services are available. Compare total cost including the services you would otherwise build yourself.
Can I move clouds later?
Yes, and it is getting easier. Under the Data Act, providers can only charge reduced, cost-based switching fees until 12 January 2027 and none after that date, although migration effort still depends on how portable your architecture is.
Weighing hosting options for a new product? Book a free 30-minute call and we will talk it through.
Cover photo by Brett Sayles on Pexels.