This guide is general information, not legal advice. Data protection rules depend on your situation; for decisions with legal consequences, ask a qualified data protection advisor.
Customers, procurement teams and auditors increasingly ask the same question: where is our data stored? With a dedicated server the answer is simple and verifiable. The data lives on the disks of one physical machine in the city you chose. This guide explains why that city matters.
GDPR applies wherever the server is
The General Data Protection Regulation protects personal data of people in the EU. It applies to you if you are established in the EU or offer goods or services to people there, regardless of where your server sits. Choosing an EU data center does not switch GDPR on or off. What it changes is whether you are making an international transfer.
International transfers
GDPR restricts transfers of personal data to countries outside the European Economic Area. A transfer is allowed when the destination has an adequacy decision from the European Commission, or when appropriate safeguards are in place, most commonly standard contractual clauses plus an assessment of the destination country's laws. That paperwork is manageable, but many organizations prefer to avoid it entirely by keeping data inside the EU.
Where each of our cities stands
- Inside the EU: Frankfurt (Germany), Amsterdam (Netherlands), Paris (France), Milan (Italy) and Madrid (Spain). Storing data here is not an international transfer.
- Switzerland: Zurich is outside the EU. The European Commission has recognized Switzerland as providing adequate protection, and Switzerland has its own data protection act.
- United Kingdom: London is outside the EU. The UK has its own version of GDPR, and data flows between the EU and the UK have been covered by an EU adequacy decision. Check the current status of that decision if UK hosting matters for your compliance.
Location is not the whole story
Where the disks sit is only one part of the picture. Also consider:
- Who operates the hardware. The company that runs the data center and its parent company may be subject to laws in other countries. Read your provider's data processing terms and ask where its support staff can access systems from.
- A data processing agreement. When a provider processes personal data on your behalf, GDPR Article 28 expects a written agreement. With an unmanaged dedicated server the provider usually has no access to your data, but it is still worth checking their terms.
- Backups and replicas. Copies count too. If your primary server is in Frankfurt but backups go to a US cloud bucket, the data has left the EU. Keep backups in a second European city, such as Amsterdam alongside Frankfurt.
- Encryption. Full-disk encryption with keys you control protects data at rest if hardware is ever removed or replaced.
- Your own tools. Analytics, email delivery, error tracking and support desks often send personal data elsewhere. A European server does not help if every request is also logged to an overseas service.
The practical answer
If your customers ask for EU hosting, pick one of the five EU cities and keep backups in another. If they need data in a specific country, choose that country's city: Germany, the Netherlands, France, Italy and Spain are all covered. For Swiss customers, Zurich keeps data in Switzerland.
