Data residency
Data residency is the question of where data is physically processed and stored — which, for AI systems, means where inference runs rather than where the vendor is incorporated or where the web interface is served. Those three diverge more often than assumed. Residency inside the EEA removes one specific legal question and leaves the rest of them entirely intact.
What it actually removes
Chapter V of the GDPR. Transfers to third countries are not prohibited; they are conditioned on an adequacy decision, standard contractual clauses with a transfer impact assessment, or a derogation. Processing within the EEA makes that chapter inapplicable, which is a substantial practical simplification and a real reduction in documentation.
It is not, however, a statutory requirement. Vendors who present EEA processing as legally mandatory are selling an argument that does not survive contact with the text — which is worth knowing, because the same argument is often attached to a premium.
What it leaves untouched
Everything else. A lawful basis is still required. Purpose limitation still applies. Access rights, retention periods, the accuracy of outputs, and the question of who reviews a result before it has effect are all unaffected by geography.
Professional secrecy can be stricter and is independent of location. A German tax practice engaging an external service for a specific client mandate needs that client's consent under § 62a StBerG regardless of where the hardware stands.
How to verify a residency claim
Three questions, and the third is the one that separates answers from assurances. Where does inference run — the region, named. Which sub-processors are involved, with their locations and purposes. And what happens on failover: many architectures that are regional in steady state are not regional when a region is unavailable.
A sub-processor list without locations does not answer the question; it moves it one level down. A supplier who cannot answer the failover question has not designed for the requirement, whatever the marketing page says.
What it is not to be confused with
Data sovereignty
Residency is about location; sovereignty is about which jurisdiction can compel access. A provider whose parent company sits outside the EU remains subject to that jurisdiction even when its servers are in Frankfurt — which is a contracting and corporate-structure question, not a geography question.
Storage location
Where documents are stored and where they are processed are separate. In a retrieval architecture the documents may never leave your systems while passages travel to a model elsewhere. The processing location is the one that governs the transfer question.
Frequently asked
Does the GDPR require EU processing?+
No. It conditions third-country transfers on Chapter V rather than prohibiting them. EEA processing makes that chapter unnecessary, which is a practical advantage and not a legal obligation. The distinction matters when a supplier prices the difference.
Is a German data centre from a US provider enough?+
It addresses residency and not sovereignty. The corporate relationship remains, and whether the arrangement holds is a matter of contract and structure rather than of where the racks are. Reasonable people reach different conclusions here; what is not reasonable is treating the server location as having settled it.
What about the model itself — does its origin matter?+
For the transfer question, no. Where a model was trained does not determine where your inputs are processed. An openly licensed model of non-European origin running on hardware inside the EEA processes your data inside the EEA. Origin can matter for other reasons; it does not matter for this one.
How do we get this into a contract?+
Name the processing region explicitly, require the sub-processor list with locations, require notice before it changes, and address failover behaviour in the same clause. The last is the one routinely omitted, and it is the one that turns a residency commitment into something that holds on the day it is tested.
Related terms
The question that separates answers from assurances
Ask a prospective supplier what happens to processing location during a regional failover. The answer, or its absence, tells you whether the requirement was designed for or written on a page.
Request a test