GDPR-Compliant Cloud Regions — EU Data Residency Guide

GDPR-Compliant Cloud Region Selection

The General Data Protection Regulation (GDPR) doesn't strictly require data to be stored within the EU, but many organizations choose EU-based regions for simplicity of compliance and to meet customer expectations.

EU/EEA Cloud Regions

Country	AWS	Azure	GCP
Ireland	eu-west-1	northeurope	europe-west1
Germany	eu-central-1	germanywestcentral	europe-west3
France	eu-west-3	francecentral	europe-west9
Netherlands	—	westeurope	europe-west4
Sweden	eu-north-1	swedencentral	europe-north1
Italy	eu-south-1	italynorth	europe-west8
Switzerland	eu-central-2	switzerlandnorth	europe-west6
Spain	eu-south-2	spaincentral	—
Poland	—	polandcentral	europe-central2

UK (Post-Brexit)

The UK has its own data protection regime (UK GDPR) that is substantially similar to EU GDPR. UK regions (eu-west-2, uksouth, europe-west2) are suitable for UK-specific compliance but should not be used for EU-only data residency requirements.

Switzerland

Switzerland is not in the EU/EEA but has an adequacy decision from the European Commission, meaning data can flow freely between EU and Swiss regions. Swiss regions are popular for financial services data due to Switzerland's strong privacy laws.

Compliance Recommendations

1. Default choice: Use Frankfurt (eu-central-1 / germanywestcentral / europe-west3) — central location, strong data protection enforcement, all providers present.
2. Backup region: Pair with Ireland or Netherlands for geo-redundancy within the EU.
3. Audit trail: Enable cloud-native logging to demonstrate data hasn't left the EU.
4. Encryption: Use customer-managed encryption keys (CMK) stored in EU regions.