Is an EU region of a US cloud provider enough for data residency?
Storing data in an EU region keeps it physically in the EU, but a provider incorporated in the US may be subject to US law that reaches data it controls. Under Chapter V of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., transfers outside the EU need a legal basis such as the EU-US Data Privacy Framework or standard contractual clauses. Ask each vendor where data is stored, who can access it and which sub-processors are involved. NetSenX publishes its sub-processor list in its data processing agreement.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does a network sensor send packet contents to the cloud?
- Can I get my data out when leaving a security vendor?
- What is the difference between data residency and data sovereignty?
- After the Schrems II ruling, can we still use security tools from US companies?
- Do a vendor’s data residency promises also cover logs, backups and support data?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).