Hacker News Reader

Comment by number6 | Hacker News Reader

Legal basis is the GDPR, however it's possible to use services outside the UK/EU if similar data protection is possible. For the US this is not the case, at least this is the ruling of the CJEU. Google would have to provide additional guarantees to protect the data. The case is identical for Microsoft 365.

I would advice for Nextcloud and Onlyoffice. If you are hardcore data protection.

View on HN

Google allows you to choose to have your gsuite data stored in the EU.

Thus is true for some SKUs, but not for nonprofit version. Must be Business, Enterprise or Essentials I believe.https://support.google.com/a/answer/7630496?hl=en

Besides the G Suite for Nonprofits Google also makes available G Suite for Nonprofits Business and G Suite for Nonprofits Enterprise which are actually just discounts on the regular Business and Enterprise products rather than the distinct G Suite for Nonprofits. I believe with these you can select the location of data storage.

Even if the data is stored in the EU, Google (or Microsoft for that matter) does not guarantee that data cannot be accessed from the US. That makes sense, since most of their operating staff is probably based in the US, but does mean that it is not GDPR-compliant, no matter what Google says about that. Google states that they are using the SCCs now Privacy Shield has been invalidated, but as Google US is an entity under reach of FISA I highly doubt that they can provide the necessary safeguards required under the GDPR and the SCCs.

Reply on news.ycombinator.com