The rules, in plain words
GDPR transfers
General Data Protection Regulation, Chapter V · Regulation (EU) 2016/679 · EU
Personal data can only leave the EU under specific legal conditions - and whether your architecture actually meets them is an engineering question, not just a contractual one.
Who it applies to. Anyone processing personal data of people in the EU. The transfer rules bite whenever that data moves to, or can be accessed from, a country outside the EU.
In plain words
GDPR as a whole is broad. The part that shapes cloud architecture is Chapter V, which governs sending personal data outside the EU. You need a valid legal basis for the transfer, and in some cases an assessment of whether the destination country's laws undermine the protection you promised.
The distinction people miss is that a transfer is not only a deliberate copy. Remote access counts. If an engineer outside the EU can reach the data to support it, that is a transfer, whether or not anything was moved.
This is why so many residency conversations end up being about support models and control planes rather than storage regions. Legal teams can paper a great deal, but they cannot paper over a design that routes data or access through a jurisdiction the customer was assured it would not touch.
Timing
When it applies.
- 25 May 2018
- GDPR became applicable.
What it means for your architecture
The part that is decided at design time.
- Remote administrative access is a transfer. Support paths need designing, not just documenting.
- Where the control plane runs matters as much as where the data is stored.
- Pseudonymisation and key separation can meaningfully change the analysis - and are architectural choices.
- 'Which regions can this data reach' should be answerable from the design, not from a policy assertion.
Read the real thing
This is an engineering explainer, not legal advice. How the rules apply to your organisation is a question for your counsel and your compliance function. What your architecture can evidence against them is the question Northkeep answers.
Also worth knowing
The other rules in play.
-
DORA
Financial firms must prove they can keep running when their technology fails - including when the failure is at a supplier like AWS.
-
NIS2
Medium and large organisations across 18 sectors must manage cybersecurity risk properly, report significant incidents fast, and hold their management personally accountable for it.
-
US CLOUD Act
US authorities can compel a US-based provider to hand over data it controls, even when that data is stored on servers in Europe.