Choosing region for database to be US / EU compliant

Question

I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a EU registered company (Estonia).

To my understanding, it is easier and more future proof to store user data on EU servers, with Frankfurt being one of the top cloud provider locations.

Assuming that the way data is collected and stored is GDPR compliant, will there be any issues with US law and their citizen data stored in EU.

Data collected is not too private, mostly it consists of user emails and some profile data i.e images / descriptions / links to social media sites.

Another aspect here is to consider where majority of users are located to reduce network latency and it so happens that roughly 70% of our target market is in US, which means that storing data there would make more sense for better user experience, but in this case, what are some implications with storing EU user data on US servers?

Answer 1

• Physical location of the data.
  From the EU viewpoint, it would be best if any data on EU data subjects is in the EU. Even data in the cloud has a physical location, remember the quip 'there is no cloud, there are only other people's computers.' And of course the database should be encrypted in storage, there should be MFA for admin access, logging of admin actions, all the usual TOM.
• Legal operator of the cloud.
  In some contexts, European regulators are getting worried about the US legislation which forces US cloud providers to cooperate with US security agencies. You mentioned Frankfurt, which sounds to me like 'AWS,' and Amazon is under US jurisdiction.

So to play it safe and avoid a migration later on, EU data should be hosted with in the EU, or servers owned and operated by EU companies. But then there are precedents where the US got antsy about data held outside the US, in China (TikTok).