Where your data lives: the data location check

Fill in one row per service

Each provider’s own pages say where it is registered and where it stores data: look for its data processing agreement, its list of sub-processors and any page on data location or residency. “Not stated” is an answer worth writing down.

Service	Provider	Company based in	Data stored in	Transfer covered by	Law that can reach it
Email
Files and documents
Calendars and contacts
Accounts and passwords
Backups
Phones and voicemail
Website and forms
CRM and customer records
Accounting and payroll
Anything else

What UK GDPR says about transfers

• A restricted transfer happens when UK GDPR applies to your processing, you initiate the transfer to an organisation outside the UK, and that organisation is a separate legal entity. Making data accessible to it counts, as well as sending it [1].
• Every restricted transfer must be covered by UK adequacy regulations, by an appropriate safeguard such as the International Data Transfer Agreement or the Addendum, with a transfer risk assessment, or by an exception [1].
• The EEA is covered by adequacy. Every EU country, Iceland, Norway and Liechtenstein has full UK adequacy, and so do others, Switzerland among them [2]. Your other UK GDPR duties still apply [1].
• The United States is covered in part. The UK Extension to the EU-US Data Privacy Framework, the “UK-US data bridge”, has been in force since 12 October 2023 [3]. It covers only a US business with an active entry on the Data Privacy Framework list that has self-certified to the UK Extension, for the kind of data you send [4]. For any other US recipient you need a safeguard or an exception [1].

Which law can reach it

Where the data is stored is half the answer. US law requires a provider of electronic communication or remote computing services to meet its obligations to preserve or disclose a customer’s communications and records in its “possession, custody, or control”, whether they are “located within or outside of the United States” [5]. That section, 18 U.S.C. § 2713, was added by the CLOUD Act on 23 March 2018 [5].

The test is possession, custody or control, not location. So for a US-based provider, a data centre in the UK or the EU changes where the data sits, and the section still applies to the provider. Write down where the company is based as well as where the data is stored. This is what the law says, not a finding about any provider.

What to do with the answers

• For each service outside the UK and the EEA, write down what covers the transfer. If it is the UK-US data bridge, check the provider’s entry on the Data Privacy Framework list [4].
• Mark any sensitive data. The framework’s idea of sensitive data is narrower than UK GDPR’s: genetic and biometric data, data about sexual orientation and criminal offence data must be marked as sensitive before they are sent [4].
• Keep the completed check with your data protection records. Review it once a year, and whenever you add a service.
• If you would rather keep the data in the UK or the EEA, the companion card lists what to prepare before a move: dacros.com/resources/eu-hosted-services-readiness-checklist

This card is general information, not legal advice.

Sources

• [1] ICO, International transfers: a guide, updated 15 January 2026, checked 10 November 2026 · ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers
• [2] ICO, Is the restricted transfer covered by adequacy regulations?, checked 10 November 2026 · ico.org.uk
• [3] The Data Protection (Adequacy) (United States of America) Regulations 2023, regulation 1, checked 10 November 2026 · legislation.gov.uk/uksi/2023/1028/made
• [4] ICO, How does the UK Extension to the EU-US Data Privacy Framework work?, updated 30 July 2026, checked 10 November 2026 · ico.org.uk
• [5] United States Code, title 18, section 2713, Required preservation and disclosure of communications and records, checked 10 November 2026 · law.cornell.edu/uscode/text/18/2713