1–10 of 74 posts
I've had some EU-based potential customers ask whether I could host their data separately on EU located servers.
I've been Googling around to get a definitive answer as to whether this is an absolute requirement or whether there is an easier way around it.
For reference, my current setup includes servers in US, a database on Google Cloud and a cloud-based ElasticSearch instance.
Any insight or experience with this would be greatly appreciated!
It is not an absolute requirement. It is often preferred from EU-based customers to store their data in EU-based data centers because then that data is subject to EU law, which can make things easier for your customers with their own legal compliance.
edit because I was incorrect It is a requirement for EU users for their data to be subject to GDPR. It is not a requirement to store that data in the EU to be compliant with the law.
You can store them outside the EU and/or with US companies, but that provider/country needs to provide the same level of data protection as they would have in the EU.
Practically, this excludes anything related to the US due to the CLOUD Act.
They've tried making this whole with the Safe Harbor and later Privacy Shield framework, but that was overturned by the European Court of Justice.
Country specific / regulation specific - depends. You'll need to make sure what their request pertains to...effectively answering "why do you want it in the EU?".
Source: https://gdpr-info.eu/art-44-gdpr/
Example of an EU rep for hire: https://edpo.com/
IANAL - but no, you definitely don't. What you do need to have in place is safeguards that any data on EU customers not hosted in the EU/EEA is subject to the same safeguards/level of protection outside the EU that it would be inside the EU. There are "standard contractual clauses" (SCCs) provided by the EU which are the easiest thing to adopt as part of (or an appendix to) your terms of service. However there is dou…
I've working for someone who has had a hard time expanding outside of NA, so it feels like I'm living on a mountaintop, and I'm still not clear on what data can live say in a central accounts database.
Sharding is a solution whose scope has been diminished substantially by consistent hashing, but with all of these provenance laws it sounds like we need something that is a hybrid of the two. Irish users' data can be stored in Ireland, Germany, Greece, and Spain, but if they're sitting in a hotel room in Chicago realizing that when people said, "it's cold in Chicago in the winter" they meant, "don't go to Chicago in the winter," not, "pack your scarf and wool socks", and so they're complaining to their friends online instead of going to MoMA in the sludge, we can't pull their user data from Ontario, we have so schlep all the way back to Cork or Brest to get their account information. Which means you have some sort of hashing of shards or shards of hashing...