“Where is our data?” is a question that is asked more and more often not by the IT department but by a CEO, an auditor or a customer before signing a contract. A few years ago the answer “in the cloud” satisfied everyone. Today it is not enough: GDPR requires you to know whether data stays within the European Economic Area, DORA and NIS2 require you to document the location of every critical provider, and public sector or financial customers sometimes simply require a data centre in their own country.
Two myths circulate in the market at the same time. The first is that data abroad is automatically insecure or unlawful. The second is that a local data centre is unnecessary sentimentality, because the big providers have EU regions and that covers everything. Both are wrong, and the truth depends on what your system does and who you answer to.
In this article we break the data location question into four practical aspects: speed, law, compliance and resilience, and explain how to combine them into a decision.
Latency: physics you cannot get around
The first aspect is technical and often underestimated. A signal travels through fibre at a limited speed, and every network hop adds its own delay. From an office in a major city to a data centre in the same country, latency is a few milliseconds. To the nearest hyperscaler regions in Northern Europe or Germany, it is tens of milliseconds.
For a website or e-mail you will not notice the difference. But some systems make many small requests to the server for every operation: accounting and ERP applications, terminal servers, remote desktops, databases with many reads, and BIM and CAD work against a file server. There, latency is multiplied by thousands of requests and turns into the user experience where the application “hangs” even though the server is not loaded at all.
In our experience this is the most common reason companies move back from a foreign region to a local data centre after six months: not because of security, but because the accounting team complained that the ERP or the terminal server was slow.
GDPR and data transfers: what is actually prohibited
The legal aspect is often misunderstood. GDPR does not require data to be stored in your own country. It requires personal data processing to take place in the European Economic Area or in countries the European Commission has recognised as providing an adequate level of protection, and in other cases to apply additional safeguards and document the transfer.
In practice this means:
- A data centre in Germany, the Netherlands or Sweden is equivalent to a data centre in your own country from a GDPR point of view. No additional transfer agreements are needed.
- The problem appears when a provider can move data outside the EEA: to US regions, support teams in Asia, subcontractors in third countries. Then you need standard contractual clauses, a transfer impact assessment and a clear answer for the auditor.
- What matters is not only the location of the primary data but also of backups, logs and support access. The contract with the provider should list the countries where data may end up.
In proposals, look not for the word “secure” but for a specific country and a list of sub-processors.
DORA and NIS2: the duty to know and document the location
If a company falls within the scope of DORA (financial institutions and their IT providers, applicable since January 17, 2025) or NIS2 (the EU directive transposed into each member state’s national law, covering important and essential sectors), data location is no longer a choice but a documented obligation.
Both require a register of third-party IT providers that states which services the provider delivers, where they are delivered, where data is stored and what the exit strategy is. DORA additionally requires an assessment of concentration risk: whether too many critical functions depend on a single provider or a single geographic location.
The practical difference between a local and a distant provider here is a question of verifiability. A data centre in your own country can be visited, its operator answers under your national law, and the contract is negotiated directly. With a hyperscaler you receive standard terms and certificates that you need to be able to read and adapt to your register. Both options are lawful, but the second requires more documentation work. We write more about this in our DORA and NIS2 sections.
Backups in another country: resilience, not a contradiction
This is where confusion often arises: if the data has to be in your own country, can backups be kept abroad? The answer is that it is not only allowed but often necessary. From a resilience point of view, a single data centre, however good, is a single point of failure. Fire, a prolonged power outage, a regional disaster: all of these must be covered by a business continuity plan, which both ISO 27001 and DORA require.
Our model is this: primary data and systems run in our data centre in Lithuania (EU), and backups are, on request, duplicated in an Amazon (AWS) data centre in Germany. Germany is in the EU, so under GDPR this is not a transfer to a third country, and the geographic distance ensures that a single event will not affect both locations. Some customers additionally use immutable backups, which cannot be altered and are invisible from the network, so that even a compromised server does not mean losing the backups.
When a hyperscaler’s EU region is the right choice
It would be dishonest to claim that a local data centre is always better. A hyperscaler region (Microsoft Azure, AWS) in the EU is the right choice when:
- The system was built for cloud services, not servers: it uses managed databases, functions, queues and AI services that a local data centre does not offer.
- Users are spread across Europe or the world, and your home country is not their centre.
- You need sudden, large-scale elasticity, such as hundreds of servers for a few hours.
- You already use Microsoft 365 and want to manage identities, security and data in one ecosystem through Entra ID and Azure.
In such cases we ourselves recommend Microsoft Azure and help choose the region and configure data residency restrictions so that data does not leave the EU.
When a local data centre is better
Conversely, a local data centre wins when:
- Systems are sensitive to latency: accounting, ERP, terminal servers, GPU workstations, databases with many transactions.
- You need someone who is responsible for the whole server, not just the platform: updates, backups, protection, and who you can reach by phone in your own language.
- Customers, auditors or internal policy require data in your own country and a provider operating under your national law.
- The workload is steady and predictable, and a hyperscaler’s pay-as-you-go pricing becomes hard to forecast.
A hybrid model: usually the right answer
For most companies, the best answer is not “either, or”. The typical architecture we see and recommend: core business systems and file servers on managed servers in a local data centre, e-mail and collaboration in Microsoft 365, identities in Entra ID, backups in two countries, and specific cloud services in an Azure EU region as needed.
In such a model, each system lives where it works best, and the data location of each one is known and documented. That is exactly what an auditor requires: not one country, but a clear answer for every system.
Where to start
- List your systems and next to each write down where it runs, where its backups are, who has access and from where. This is the basis of your provider register.
- Check whether any system can end up outside the EEA, including support access and subcontractors.
- Measure latency from workstations to your current servers. If systems “hang”, this is often the cause.
- Decide which systems need a local data centre and which are fine in an EU region, and make sure backups are in a different place than the primary data.
- If you need help with the assessment, our risk assessment service includes an analysis of providers and data location, and managed CLOUD servers in our data centre in Lithuania (EU) are the foundation where most hybrid models begin.
