Where does company data have to be stored? EU servers, third countries and data transfers

Nowhere does the GDPR literally require company data to be stored on servers in the EU. It does, however, strictly govern the conditions under which personal data – that is, data relating to customers, employees or suppliers – may be transferred to countries outside the EU. In practice this means: with an EU provider and EU servers, you avoid the entire subject of “third-country transfers”. With a provider from a third country, you have to check, agree and document additional safeguards.

In brief

• The GDPR has no obligation regarding server location, but it requires a separate legal basis under Chapter V of the Regulation for every transfer to a third country.
• A third country is any country outside the EU and the European Economic Area; the most common case in practice is the USA.
• An adequacy decision currently applies to certified US companies (Data Privacy Framework); both of its predecessors were struck down by the Court of Justice of the European Union.
• Server location alone is not enough: remote access from a third country – for example by support teams – also counts as a transfer.
• Where your data is really stored is set out in the data processing agreement (DPA) and in the list of sub-processors. That is where every serious check begins.

Does the GDPR require an EU server location?

No – and this misunderstanding is stubbornly persistent. The GDPR is not tied to the location of the server but to the processing of personal data. In principle, you may have such data processed outside the EU as well, but you must then comply with the rules in Chapter V of the GDPR (Art. 44 et seq.). These require that the level of protection under the GDPR is not undermined by the transfer.

Two clarifications help put this into context. First: the GDPR only concerns data relating to individuals. Pure machine data or formulations without any connection to individuals are not covered – but in practice almost all business documents contain names, email addresses, signatures or direct-dial numbers, which establishes that connection. Second: even beyond the GDPR, there are good reasons for a controlled storage location, such as protecting trade secrets, cost calculations and know-how.

What applies to transfers to a third country?

For transfers to countries outside the EU and the European Economic Area, the GDPR essentially provides three routes:

1. Adequacy decision: The European Commission certifies that a country has an adequate level of data protection. Such decisions exist, for example, for Switzerland, the United Kingdom and Japan. For the USA, the Data Privacy Framework has applied since 2023 – but only to US companies that have certified under it.
2. Appropriate safeguards: Where there is no adequacy decision, standard contractual clauses – contract templates drafted by the European Commission – are the main option. In addition, it must be checked case by case whether the law of the destination country undermines the contractual commitments.
3. Exceptions for individual cases: For example, the explicit consent of the person concerned. For ongoing business operations, these exceptions are not a viable foundation.

A look at the history explains why the subject is so delicate: both predecessors of the Data Privacy Framework – Safe Harbor and Privacy Shield – were declared invalid by the Court of Justice of the European Union. The General Court of the EU upheld the Data Privacy Framework on 3 September 2025 (T-553/23, Latombe); an appeal to the Court of Justice is pending (C-703/25 P). So some residual uncertainty remains. If you do not want to rely on it, choose the route that works without any third-country transfer. The Austrian Data Protection Authority (dsb.gv.at) provides information on data transfers to third countries.

Which set-up means what for your company?

Set-up	What it means for you
EU provider, servers in the EU	No third-country transfer. The simplest set-up: check the data processing agreement (DPA), done.
Provider from a third country, servers in the EU	Server location alone is not enough – remote access from the third country (support, administration, parent company) must be checked and safeguarded.
US provider, certified under the Data Privacy Framework	Transfer currently possible on the basis of the adequacy decision. The certification of the specific company should be checked.
Provider in a third country without an adequacy decision	Standard contractual clauses plus a case-by-case assessment needed – laborious for SMEs and with residual risk.

Why is server location alone not everything?

“Servers in Frankfurt” sounds reassuring, but only answers part of the question. Four points are often overlooked:

Remote access counts as a transfer. If a support employee outside the EU can access data stored in the EU, that is a transfer under data protection law. So do not just ask where data is stored, but also from where it is accessed.

Sub-processors. Behind a provider there are almost always further service providers – data centres, analytics tools, support platforms. If one of them is based in a third country, the transfer is back. The list of sub-processors is part of the data processing agreement (DPA) and should be read.

Laws of the country of origin. US laws such as the CLOUD Act can, under certain conditions, oblige US providers to hand over data – even if it is stored in Europe. How far this goes in an individual case is legally disputed; but you should be aware of the tension.

Encryption and key management. Whoever holds the keys controls access. Encryption whose keys are held by the provider in a third country does not protect you against that provider.

How can you check in five steps where your company data is stored?

1. Read the data processing agreement (DPA): The storage location must be named specifically – “EU” or, better still, the country of the data centre. Vague wording such as “globally distributed infrastructure” is a warning sign.
2. Go through the list of sub-processors: Where are the subcontractors based? Are changes actively communicated?
3. Clarify remote access: From where do support and administration work? Is there access from third countries, and how is it safeguarded?
4. Check training exclusion and purpose limitation: With AI services in particular, it should be contractually excluded that your documents are used to train the models.
5. Put commitments in writing and file them: Commitments on server location belong in the contract, not just on the website – and the contract belongs somewhere you can find it immediately when needed.

The Austrian Economic Chamber (WKO, wko.at) also offers practical data protection guides for businesses. And for context: this article sets out the basic principles and does not replace legal advice in an individual case – if you have specific doubts, seek professional advice.

What does this mean for AI tools and knowledge bases?

With AI services, the question of where data is stored is particularly important, because they process not individual form entries but whole documents: contracts, quotes, service reports, internal instructions – with all the personal data they contain. An AI knowledge base with EU data storage avoids third-country transfers from the outset, does not use customer documents to train third-party models and names the source document for every answer, so that you can check the statement.

Server location is only one of several building blocks of GDPR-compliant AI use – alongside the data processing agreement (DPA), training exclusion and access control. How these building blocks fit together is shown in the overview article AI and the GDPR in Austria.

As a rule of thumb: ask every provider two things – “Where is the data stored?” and “Who can access it, and from where?”. A provider that answers both clearly and in writing is usually the right choice. You can see how a rollout with EU data storage works step by step under how the rollout works.