EU-Sovereign IT for UK Businesses

What EU-sovereign IT means

For a business, EU-sovereign IT means running email, files, sign-in, backups, phones and websites with providers based in the UK, the EU or Switzerland, which keep the data there. Two questions sit behind every choice: where the data is kept, and which company holds it. A provider can keep data in a London data centre and still be a company of another country, and it is the company, not the building, that a court order is addressed to.

None of this makes a US provider unlawful. Many UK businesses use US services lawfully, and if yours is one of them, nothing here says you must leave. It means knowing the answer to both questions for each service you use, writing it down, and choosing deliberately when a contract comes up for renewal or something new is set up.

What the law says

Three texts set the position for a UK business, each linked to its source.

• UK GDPR’s transfer rules. The ICO’s brief guide to international transfers treats a transfer as restricted when UK GDPR applies to the processing, you initiate the transfer to an organisation located outside the UK, and that organisation is a separate legal entity. Where adequacy regulations cover the destination, the information can flow without any additional safeguard. Every EEA country and Switzerland has full UK adequacy; the United States has partial adequacy.
• The UK-US data bridge. The Data Protection (Adequacy) (United States of America) Regulations 2023 came into effect on 12 October 2023. They cover transfers to US organisations that take part in the UK Extension to the EU-US Data Privacy Framework, and only those (GOV.UK). A transfer to a US recipient outside it usually needs a safeguard, such as the ICO’s International Data Transfer Agreement, with a transfer risk assessment showing that protection is not materially lower after the transfer.
• The US CLOUD Act. Section 2713 of title 18 of the US Code, added by the CLOUD Act in 2018, requires a provider of electronic communication or remote computing services to meet its US obligations to preserve, back up or disclose communications and customer records in its possession, custody or control, “regardless of whether such communication, record, or other information is located within or outside of the United States”.

Read together, they explain why the two questions are separate. The transfer rules are about where data goes; section 2713 is about which law reaches the company that holds it, wherever the data is kept. Our guide to international data transfers under UK GDPR explains the transfer mechanisms in more depth.

Start with what you have

Most of the work is records UK GDPR already asks for. If the basics are new to you, start with GDPR basics for UK small businesses and lawful basis, explained. A record of processing lists the personal data you hold and why; add three columns for each service, the provider, the country its company is in and the country it keeps the data in, and you have a map of where your data stands. Your privacy notice has to tell people when their data is transferred outside the UK, so the same answers belong there too.

When a new system will hold sensitive data, a data protection impact assessment is the place to record why you chose its provider.

Choosing providers

Ask each supplier the questions in our guide to third-party and supply-chain risk, starting with where your data is stored and who can see it. Then check two facts on the provider’s own pages: the country its company is incorporated in, and the region your data is kept in. We name European providers only with those facts, taken from their own pages, and say so wherever we have an affiliate link, as our affiliate disclosure explains.

Our own providers are on our sub-processor list, which says which are European and which are not: Scaleway, OVHcloud, Hetzner and Proton are European companies, while Vercel, which hosts this website from London, and Cloudflare, which runs its DNS, are US-incorporated.

Email, files and sign-in

Email and shared files hold most of a business’s personal data, so they are usually the first services worth deciding about. Secure file sharing covers what good file sharing looks like wherever the files are kept, and cloud versus on-premise weighs up keeping some systems in the office. Your domain’s DNS decides where your email is delivered, so domain names and DNS basics is worth reading before any move.

When you are ready, moving to European providers sets out how we run the move: an inventory, then email, files, calendars and sign-in, your staff, the cut-over and the checks afterwards.

Backups with a second provider

A backup kept with the same provider as the original depends on the same account, the same company and the same law. Our backups and disaster recovery work keeps encrypted copies with a second provider in the EU or the UK, and tests the restore. Our write-up of what we found auditing our own recovery setup shows why the copy, and the way back to it, must not depend on the thing it protects.

Your website

A website’s analytics, embedded media and other scripts can send visitors’ data to other companies, which is a question for cookies and PECR as much as for transfers.

When something goes wrong

Reporting a breach to the ICO and answering a subject access request both start from knowing which provider holds what.

If you are on Microsoft 365 or Google Workspace today

You do not have to move to use any of this. We look after Microsoft 365 or Google Workspace for a business on it, and plan a move only when you want one. The managed IT hub covers both platforms, and our data protection hub covers the rest of UK GDPR.

Where to start

If you would like a hand, book a free IT and security review. It is done remotely, and the written picture is yours to keep either way.