Data Residency

Data residency describes the physical and geographical location where personal data is stored and processed, for example in data centres in the EU. Under the GDPR it matters because transfers to countries outside the EU/EEA are only allowed under the conditions of Chapter V, such as an adequacy decision or standard contractual clauses.

What is data residency?

Data residency means the place where your data physically lives: the country or region of the data centres that store and process it. When a provider says your data is hosted in Frankfurt, that is a statement about data residency.

Under the GDPR, location matters because of Chapter V (Articles 44 onwards). Personal data may only be transferred to a country outside the EU/EEA if one of these conditions is met:

  • Adequacy decision (Article 45): the European Commission has decided that the country offers an essentially equivalent level of protection. Examples include the UK, Switzerland, Japan and, for certified companies, the US under the EU-US Data Privacy Framework.
  • Appropriate safeguards (Article 46): most commonly standard contractual clauses (SCCs), combined with an assessment of whether they can be honoured in practice in the destination country.
  • Narrow derogations (Article 49), such as explicit consent for a specific transfer. These are meant for exceptions, not for routine business processing.

The UK applies the same structure under the UK GDPR. It treats the EU/EEA as adequate, so data can flow from the UK to EU data centres without extra paperwork, and it has its own extension to the Data Privacy Framework (the “UK-US data bridge”), in force since 12 October 2023.

Residency is not the same as sovereignty

Data residency answers where data is stored. Data sovereignty asks whose laws can reach it. A server in Frankfurt operated by a company headquartered in another country may still be subject to that country’s laws on access by authorities. That is why the debate after Schrems II focuses not only on location but also on contracts, encryption and the provider’s legal set-up.

Why EU hosting matters for SMBs

For a small or mid-sized business, EU hosting is mainly a matter of reducing effort and risk:

  • Less paperwork: if a processor stores your data in the EU, there is no third-country transfer to justify for that part of the processing.
  • Trust in regulated sectors: law firms, accountants, insurance brokers and healthcare-adjacent businesses are regularly asked by clients where their data is kept. A clear answer helps close deals.
  • Fewer moving parts: transfer mechanisms can change after court rulings. Data that stays in the EU is not affected by that kind of change.

Example: a law firm in Bristol

A law firm in Bristol is choosing a messaging platform to answer client enquiries on WhatsApp and live chat. It compares two options: one provider hosts everything in a US data centre, the other in the EU. With the US provider, the firm would need to check certification under the UK-US data bridge or put transfer safeguards in place and assess them. With the EU provider, the UK’s adequacy regulations for the EU cover the hosting side.

The firm chooses the EU-hosted platform, has the hosting location written into the data processing agreement, and records it in its records of processing activities. It also notes one thing the hosting location cannot change: WhatsApp messages pass through Meta, which processes them under its own terms.

Data residency at SendSeven

  • Hosted in the EU (Frankfurt, Google Cloud). Platform, database and the optional AI run in European data centres.
  • Encrypted in transit (TLS) and at rest.
  • AI off by default, and your data is never used for model training.
  • A DPA under Article 28 documents the processing relationship.

One honest caveat: SendSeven’s hosting location does not cover the channel providers. When you message customers on WhatsApp, Instagram or Messenger, Meta processes that data under its own terms, including outside the EU and in the US. Meta relies on the EU-US Data Privacy Framework and standard contractual clauses for these transfers. Email, SMS, live chat, Telegram and Browser Push do not involve Meta. Your TOMs and transfer documentation should reflect this per channel. More in GDPR-compliant messaging.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.