If you collect personal data from people in Europe, where you host it and how you treat it are separate questions with separate answers. This guide untangles them in plain language. It is general information, not legal advice.
GDPR follows the people, not the server
The EU's General Data Protection Regulation applies when you offer services to people in the EU or monitor their behaviour, wherever your business or servers are. Moving a server to another country does not remove your obligations to those users.
What hosting location does change
- Which authorities can request access. Data stored in a country is subject to that country's lawful-access rules.
- Data transfers. Moving personal data out of the EU needs a legal basis, such as an adequacy decision or standard contractual clauses.
- Practical risk. Retention laws, court procedures and enforcement practice differ between countries.
- Latency and cost. Closer is faster, and some locations cost less.
Locations in practice
| Location | Framework in brief |
|---|---|
| Germany, Netherlands, Finland, Romania | EU member states, so GDPR applies directly and data stays inside the EU. |
| Switzerland | Own Federal Act on Data Protection, which the EU recognises as adequate. |
| United States | No single federal privacy law; state laws vary and transfers need a legal basis. |
| Panama, Singapore, Seychelles, Moldova | Each has its own data-protection statute with different scope. Check current rules for your case. |
Laws change, so confirm details with a qualified professional before relying on any summary.
What you should do whatever the location
- Collect only the data you need, and delete it when you no longer need it.
- Encrypt data in transit (HTTPS) and at rest where possible.
- Publish a clear privacy policy and honour access and deletion requests.
- Keep software updated and limit who can log in.
- Keep a record of where you store personal data and who processes it.
Offshore does not mean outside the law
Hosting abroad can suit privacy, resilience or cost, but you stay responsible for obeying the laws that apply to you and your users. See what an offshore VPS is and how to choose a location.