Deleted user
Lawyer
posted 4 years ago
The GDPR does not include any data residency or localization requirement, instead, it provides the obligation to keep the data secure inside the EU and if the data is to be transferred outside of the UE, then it can only be transferred to countries or organisations that have signed up to equivalent privacy protection.
Article 45(1) of the GDPR states that:
1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
it is important to note that local law might impose some requirements on the location of the data storage (e.g., Russia’s data localization law, German localization law for health and telecom data, etc.).
