We're a global company and are expanding to Europe. We have users log in to our service and then they can use it.

If a user is from the EU, do we have to store all of their personal information inside of the EU? i.e. email/username/password


No it is not required to keep personal data in the EU. But additional provisions apply if you move data out of the EU, see Art. 44 GDPR:

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

See the other articles in chapter 5 for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.