Most people arrive at this subject from one of two directions. Either a customer has asked where their data sits and the honest answer turns out to be longer than expected, or you are the buyer and a provider's regional selector has just been offered to you as the whole answer. Both directions run into the same problem: "where is the data" is three questions wearing one coat.
The question is asked hardest by buyers in Germany and the wider German-speaking market, and not only for data protection reasons. Tenders, works councils, supervisory authorities and large customers all ask about the processing location. Operational security is part of it, as is which law applies to a contract, whether the provider can be reached in a dispute, and the expectation that a service stays usable through political turbulence. Treating it purely as a data protection question answers it incompletely.
Three questions that get compressed into one
- Where does the data sit at rest? The place of storage, and what the region selector in the administration console addresses.
- Where is it accessed from? Remote maintenance, support in other time zones, fault analysis, telemetry and analytics are all processing, even when the data physically stays put.
- Which legal orders are the provider and its affiliated companies subject to? Legal orders a provider is subject to may provide for access powers that operate independently of where the data is stored.
A statement of region answers only the first question. The other two are in the contract or nowhere.
What else counts as residency
Frequently overlooked: backup copies and their locations, failover data centres for disaster scenarios, log and metadata, the contents of support tickets, analytics and training environments, and the provider's own subcontractors for content delivery, email dispatch, telephony or ticketing. The application itself sits in the region you asked for, and the notification mail relay sits somewhere else.
A location is not proof of compliance
A data centre in Germany does not make a processing operation lawful. The legal basis, the processing agreement under Art. 28, information duties, data subject rights, deletion and the technical and organisational measures under Art. 32 all have to be examined and documented independently of location. Nor does a provider's certificate or attestation prove the lawfulness of your processing: it describes the audited area of the provider, not your configuration and not your purposes. Where data is transferred to third countries, appropriate safeguards are required; which instrument carries the case is a question for legal review.
Anchoring it in the contract
| Point to be agreed | Why it is needed |
|---|---|
| Exhaustive list of processing locations | Turns a marketing statement into a checkable commitment |
| Locations of backups and failover sites | Backups frequently migrate to other regions |
| Terms for remote access for support and maintenance | Access is processing, even without moving data |
| Right to consent to or object to new subcontractors and locations | Otherwise changes go unnoticed |
| Notification of official access requests, so far as legally permissible | Precondition for any reaction of your own |
| Return and deletion at the end of the contract, including backups | Without this the exit ends incomplete |
| Place of key management | Decides who can technically make the data readable |
Sovereignty offerings, soberly assessed
Offerings marketed with words like sovereign, European or national differ considerably. Check four points rather than the label: who is the operating company and which law is it subject to, what are the ownership and control relationships, where does key management sit, and how far does support access reach. Those four answers say more than any product name.
Where the location answer breaks down
- The region selector is treated as the final answer to the location question.
- Backups and failover sites are not examined alongside.
- Subcontractors for peripheral functions remain unknown.
- Location is treated as a substitute for the data protection assessment.
- Location commitments live in the presentation, not in the contract.