Ask HN: Follow the law based on server location or company location?
While working on our business plan, something occurred to me that did not occurred before: as a hosting provider, do I follow the laws where my servers are located or the ones where my company is located? We are looking to keep our servers in Germany — price to performance ratio — or Iceland, while the company will be incorporated in Brazil or Panama — because moving to the EU is not an option, unfortunately —, depending on whatever my wife and I decide to move to Panama or not this year.
In Brazil we have a data retention law — the laws mention ISPs, but I am guessing a hosting provider would be on the hook too —, but Iceland does not — as far as I know. So if we were hosting our servers in Iceland, but the company itself was registered in Brazil, which law would take priority?
Right now our servers are configured to keep access logs — with anonymised IP addresses — for seven days, and no backups of those logs are kept. We also have a few VPNs for personal use and logs are disabled on those machines, so in Iceland that would not be a problem... but I think it would in Brazil? Data retention logs usually have "ISP" written here and there, but it seems to be a blanked statement that means any company with a server.
I am looking for a lawyer with a privacy and hosting focus to get everything sorted, as laws are obviously not my forte, but the search has been frustrating so far.