Honest Consultancy. Updated
Does using an EU region make us GDPR compliant?
No. Region choice controls where data is stored. GDPR also covers how it is processed, who can access it and how long you keep it, and you remain responsible as the controller.
Cloud providers work on a shared responsibility model: they secure the infrastructure, and you configure access, encryption, logging and retention in your account.
Where can data leave the region without us noticing?
Backups and replicas in other regions, logs shipped to third-party tools, support access, and global services that are not tied to one region.
Map every place a copy of personal data ends up, including monitoring, analytics and ticketing tools.
Microsoft completed its EU Data Boundary for Microsoft cloud services in February 2025. Read its documentation for which services and data types it covers, and what still leaves the EU.
What if a provider or tool transfers data outside the EEA?
GDPR Chapter V requires a legal basis for the transfer, such as an adequacy decision or standard contractual clauses.
For the United States, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework in July 2023. It covers transfers to US companies that take part in that framework.
Who regulates this in Ireland?
The Data Protection Commission (DPC). Its guidance is the first place to check for Irish organisations.
