13

I co-founded a tele-health startup, we are expanding to Germany, we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found conflicting information online.

Should the data be stored in a German data center? is it a requirement? Would it be ok to have it stored outside Germany? How about outside the EU?

Thanks

Improve this question
1
  • 1
    It's not the "German GDPR". The GDPR is an EU regulation, not a german one. It isn't even called "GDPR" in Germany, by DSGVO (the abbreviation of the german translation of the name).
    – Tom
    May 14, 2023 at 5:30

1 Answer 1

Reset to default
26

The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in which member state data is stored or processed. Member states cannot generally limit this single market via national laws.

Furthermore, secure processing may be possible outside of the EU/EEA as discussed in Chapter 5 of the GDPR. Some countries such as Japan have been asserted an adequate level of data protection so that no special safety measures are necessary. For other countries, a transfer of personal data may be possible under so-called Standard Contractual Clauses which detail the responsibilities of the data exporter/importer.

However, the recent Schrems II ruling has invalidated the (partial) adequacy decision for the United States, and has strongly hinted that SCCs only work if the parties are actually able to honor their responsibilities under the SCC (which is not the case with some surveillance laws). Data protection is likely not ensured for processing in the US or by US-controlled companies (even if the processing usually takes place within the EU). Given the sensitivity of health data, this means you should likely avoid using the typical public cloud providers (regardless of availability region). Depending on where your company is based, you might also be disqualified as a data processor by EU data controllers.

So the GDPR has no data residency requirements that limit the processing/storage to Germany, but some data residency requirements to keep the data in the EU. However, there may be non-GDPR obligations that mandate how the data can be processed, but I'm not familiar with those (the German regulatory landscape for tele-health is very uneven, differs between German states, but is also improving a lot recently).

Since you're processing health data, you should pay special attention to Art 9(3) GDPR which is expanded in German law by §22 BDSG to list a catalogue of possible safety measures you should consider, but none of them are related to data residency. §78 BDSG has further details on transfers into non-EU countries, such as emphasizing that human rights must be guaranteed in the target country.

Improve this answer
2
  • 3
    "should likely avoid using the typical public cloud providers" - I'm curious if this applies to "sovereign clouds" like Azure Black Forest.
    – Dai
    Jul 27, 2020 at 6:10
  • 8
    @Dai Azure Germany is managed by a German trustee and not by Microsoft, so the problematic US spying laws have no effect there. I expect that workloads running there are unaffected by the Schrems II ruling. However, Azure Germany stopped accepting new customers in 2018.
    – amon
    Jul 27, 2020 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .