if it's viable, I would try to host all data in the EU for all your EU customers regardless of the legal situation. Because the legal situation is likely to change further - just plain and simple, it's a risk, and if your cost in avoiding that risk is sufficiently low, that might be worth it. And you can advertise it as a benefit to your customers.
It's a pain to implement and only adds more complexity to my setup for a tiny percentage of customers; but on the other hand the more I dig into the answers, the more unclear things get with recent rulings overturning common practices.
It's unfortunate that finding the answer to such a simple question seems to require lawyers, especially for a small business like mine. I wish we could protect data and privacy without opening Pandora's box.
"It's unfortunate that finding the answer to such a simple question seems to require lawyers, "
Yes, and it's the a problem for the EU. While there is definitely a need to have some kind of regulatory elements in place, the degree of complexity involved creates considerable constraints and overhead for ultimately very little gain.
There is probably a version of this legislation, or even better, some kind of 'data treaty' between WTO or OECD nations that makes this work out with a lot less overhead.
Believe me, I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) and I don't want to add complexity to my setup, but I am trying to grow my business: if it works out financially with enough new EU customers, then the headache could be worth it.
"The headache will be worth it"
Those are contradictory, which is my point.
What if it turns out you really don't need to host your data in the EU? Then it definitely 'will not have been worth it'.
Unless there is some timing risk whereby you risk actually damaging your business because you're under threat of service degradation or litigation because you're 'behind the ball' in which case there might be some rationale for doing it ahead of time.
We don't even know for sure what bits of data might need to be moved to be compliant, or that the 're-architecture' itself may not be sufficient and will require 'another rearchitecture' ...
Do something when it's clear that it needs to be done, otherwise, I don't see how there is any upside at all.
I interpret the law as requiring it anyway, but I view this as carrot-and-stick.
EU law states: EU data shall not leave the EU.
Those two bite each other, and the result is that a company can _never_ bow to both laws.
So, if EU data must be kept in the EU, choose a (hosting) company with no ties to the US. Vice versa is no problem, the EU law _does_ respect data locality.
It is the reason why we had to move away from Hetzner, when they opened a US office/branch.
(https://docs.hetzner.com/general/general-terms-and-condition...
If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you)
Splitting up operations from a single data centre (vast majority of situations) is quite costly and adds a lot of complexity.
'You can advertise to your customers' - except that nobody really cares that much, or at least care enough to the point it makes a difference in terms of purchasing behaviour. I mean - everyone would 'like to know that their data is local' but that does not translate into purchasing behaviour or pricing intent in most cases.
Aside from 'real costs' of doing such a thing, opportunity costs are always high. There are always '10 critical things' to work on right now, who has an extra team of Engineers to work on 'maybe it will be useful someday features?'.
Finally - it's not a hugely helpful exercise in the end: it doesn't mater that-that much 'where' the data is.
People want to know that their data is protected and that's that. So just do that, which everyone should do.
That's a very generic statement on a situation that can have a zillion factors ;)
> 'You can advertise to your customers' - except that nobody really cares that much,
I do know quite a bunch of people who care, so "nobody" is demonstrably wrong. That said, the people I associate with tend to be tech-savvy, privacy conscious and have disposable income, so I'll agree it's probably not a large percentage. But I don't know what OP's target audience is either...
There is 'one factor' that's relevant, and that is there is no apparent need to move data to the EU, and even not that basis it's not clear if that would be sufficient.
The 'factor' is that it's a fuzzy requirement at best that definitely will require investment and opportunity cost.
" so "nobody" is demonstrably wrong. "
It's besides the point, there are almost 0 products on the market for which 'hosted in EU' will move the needle on customer acquisition. Maybe some SaaS here and there, but even in that case, it would be a feature that could be researched and then one could write a material business case around 'moving it to the EU to acquire customer segment X which is worth $Y in revenue. And that's definitely something that would start coming back from the sales team i.e. 'Big EU Co. asked about this, it's going to be key in the sale' - which is how regular product operations are done.
But without needing to do it, it makes little sense.
So not really sure if they were right, but according to them even just having your servers run by a US company is a potential legal risk with GDPR.
But at the same time other departments in the same organization run on Azure.
EU cloud hosting companies however are not as mature as the big US players so makes it more of a pain.
As a European, I don't really care of the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. It does not change anything to my life. What I do care is that my sensitive data are kept securely. And even my government if failing to do that, so before they impose anything to the latest SAAS I subscribed to, they have a ton of work to do in-house.
I also care about what people post about me, but GDPR has an exemption for public data, so I am not more protected today than I was yesterday.
I am sure someone, somewhere feels all warms and fuzzy about "protecting" the European citizen, but boy did he miss the mark.
That's not what it's about, it's about weather you consent to third party cookies or not.