-1

I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a EU registered company (Estonia).

To my understanding, it is easier and more future proof to store user data on EU servers, with Frankfurt being one of the top cloud provider locations.

Assuming that the way data is collected and stored is GDPR compliant, will there be any issues with US law and their citizen data stored in EU.

Data collected is not too private, mostly it consists of user emails and some profile data i.e images / descriptions / links to social media sites.

Another aspect here is to consider where majority of users are located to reduce network latency and it so happens that roughly 70% of our target market is in US, which means that storing data there would make more sense for better user experience, but in this case, what are some implications with storing EU user data on US servers?

Improve this question
2
  • 1
    Is there some reason why you think you should store all your users' data in the same place?
    – phoog
    Dec 31, 2022 at 17:49
  • I am not aware of US data location requirements, but a quick pointer on the European perspective: you're an EU-based company, so GDPR applies to all data processing activities, even those relating to users from the US. Processing data in the US is tricky/impossible since Schrems II. However, other countries have an EU “adequacy decision”, allowing you to process data in them with little additional red tape. In North America, Canada is the only country with an adequacy decision. An adequacy for the US is currently in the process of being finalized, but it's on shaky legal ground.
    – amon
    Jan 1 at 10:01

1 Answer 1

Reset to default
0
  • Physical location of the data.
    From the EU viewpoint, it would be best if any data on EU data subjects is in the EU. Even data in the cloud has a physical location, remember the quip 'there is no cloud, there are only other people's computers.' And of course the database should be encrypted in storage, there should be MFA for admin access, logging of admin actions, all the usual TOM.
  • Legal operator of the cloud.
    In some contexts, European regulators are getting worried about the US legislation which forces US cloud providers to cooperate with US security agencies. You mentioned Frankfurt, which sounds to me like 'AWS,' and Amazon is under US jurisdiction.

So to play it safe and avoid a migration later on, EU data should be hosted with in the EU, or servers owned and operated by EU companies. But then there are precedents where the US got antsy about data held outside the US, in China (TikTok).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .