Hosting data in the EU: what it means and do you need it?

A sales manager receives a security questionnaire from a large customer. Question 14 reads: “Where is our data stored, and is it transferred to countries outside the EU?” She asks the IT lead, who asks the web agency, who replies that the server is in Frankfurt. But the questionnaire also asks about subcontractors, and it turns out that emails are sent via an American service, error reports go to another, and the new AI feature calls a model nobody has checked. The order waits three weeks while the answers are found. That is why hosting data in the EU has become a sales and procurement question as much as a legal one.

We are a software company, so this guide is a practical overview of choices and questions. The legal assessment of your transfers, especially if you process sensitive data, should come from a lawyer specialising in data protection. Datatilsynet also publishes guidance on transfers to third countries.

Why does it matter where data is hosted?

GDPR allows personal data to move freely within the EU and EEA. Transfers to other countries, known as third countries, require a specific basis: a decision by the European Commission that the country offers an adequate level of protection, or safeguards such as the EU’s standard contractual clauses, often combined with an assessment of the risks in the recipient country. For the US, the EU-US Data Privacy Framework covers certified companies. Two earlier arrangements were struck down by the EU Court of Justice, most recently in the so-called Schrems II judgment in 2020, which is why many are cautious about building their whole solution on the assumption that the current arrangement will hold.

• Legal simplicity: data in the EU with an EU supplier needs no transfer mechanism and fewer documents.
• Resilience: you are less exposed if a transfer arrangement is struck down again.
• Sales and procurement: large customers and public bodies increasingly ask for EU hosting.
• Trust: customers who share personal information like to know it stays in Europe.
• Speed: shorter distance to users gives slightly lower response times, especially for apps and portals.

EU region or EU provider?

There is an important nuance. Many American providers offer to store data in an EU region. That means the data physically sits in Europe, which solves a large part of the problem. The provider is still subject to US law, though, and support or operations from outside the EU can itself be a transfer. Many of the large providers have specific EU commitments and agreements that limit this. A European provider without an American parent company removes the question entirely. Which solution fits depends on your data, your customers and your appetite for risk.

Which options do you have for hosting in the EU?

For a modern website or web app built in Next.js, it is typically possible to place the database, files and server functions in the EU. It requires someone to actively choose it. Default settings in many services point to the US, because that is where most of their customers are.

Which parts of a solution send data out of the EU?

The issue usually sits in all the small services around the server. A typical web solution uses eight to fifteen external services, and each of them can send personal data somewhere else. Go through the list below with your supplier.

• Email delivery: order confirmations, password resets and newsletters.
• Analytics and heatmaps: visit data, IP addresses and session recordings.
• Error monitoring: error reports often include the user’s email or ID.
• AI services: text from customers sent to a language model to be answered or summarised.
• CDN and image optimisation: may cache content globally, including pages with personal data.
• Support and chat: conversations with names, addresses and order history.
• Backups and logs: copies of the whole database or of all traffic.
• Payments, SMS and signatures: usually independent controllers with their own terms, but check them.

AI is the service that most often slips in unchecked. Several AI providers now offer EU processing for business customers. Read more in our guide to an AI chatbot for your website, where we cover the GDPR side.

What does hosting data in the EU cost?

Hosting is rarely the big item in a digital budget. The price depends on traffic, data volume, uptime requirements and whether someone needs to keep an eye on it all. The ranges below are typical market prices for hosting alone without development, and they cover both European providers and EU regions at the large clouds.

With us, hosting is part of the fixed monthly price, which also covers maintenance, updates, support, security and backups. For a website it starts at DKK 600 a month, and for an app at DKK 1,200. See the details under pricing. Whoever you choose, the hosting location should be stated in writing in the proposal and in the data processing agreement.

Which questions should you ask your hosting supplier?

1. In which country and which data centre are our database and files stored?
2. Where are backups stored, and for how long?
3. Which sub-processors do you use, and where do they process data?
4. Do your support or operations staff access data from outside the EU?
5. Which transfer mechanism is used if data leaves the EU?
6. In which country is your parent company based?
7. Will we be notified before you add new sub-processors?
8. How do we get all our data back if we want to change supplier?
9. Where are logs and error reports sent?
10. Is all of this written into the data processing agreement?

Question 8 ties in with ownership. If you own the code, data and accounts yourselves, it is easy to change supplier or region if requirements change. Read more in our guide who owns the code.

Should every company choose pure EU hosting?

Our view is pragmatic. Core data belongs in the EU, because it is easy and cheap to ensure today. For the small services around the solution, we recommend choosing EU alternatives where they are just as good and documenting the rest. If you process health data, CPR numbers, data about children or data for public customers, we go further and recommend involving a lawyer in the choice.

How do you move a solution to EU hosting?

An example: an accounting firm with 30 employees has a customer portal where clients upload documents. The database is already in the EU, but the files sit in an American region, emails go through an American service, and error reports contain client emails. Moving the files takes a couple of days, the email service is switched to an EU provider, and error reports are cleaned of personal data. Altogether it is typically a one-to-two-week task and a small change to the monthly bill. The result is that the next security questionnaire can be answered in an afternoon.

Hosting is one piece of the puzzle. See also our guides to GDPR for websites and apps and the software security checklist. If you need a solution where the data location is clear from day one, get a fixed price within 24 hours.