Sooner or later, someone asks the question. It might be a client working through a vendor security questionnaire, an auditor with a checklist, or a procurement contact who has just read about another GDPR fine. The question is always a version of the same thing: where is our data actually stored?
For many businesses, the honest first answer is “somewhere in the cloud”, followed by a slightly nervous search through old contracts. That answer was never ideal, and in 2026 it is getting much harder to defend.
The regulatory calendar has been busy. At the end of July, the EU’s Digital Omnibus on AI entered into force, pushing back the AI Act’s high-risk deadlines while keeping its transparency obligations on the August 2026 schedule. Meanwhile, GDPR enforcement keeps returning to one theme: where personal data goes, and who can reach it once it gets there. The largest transfer-specific fine in GDPR history, €530 million against TikTok, came down to exactly that question.
If “data sovereignty” has landed in your inbox recently and you want to understand it before you reply, this is the plain-language version.
What Data Sovereignty Actually Means
Data sovereignty is the principle that data is governed by the laws of the place where it is collected and stored, and that those laws decide who can access it and under which conditions. For a European business, it means your customers’ data stays under European legal protection, without another jurisdiction reaching in through the back door.
Data residency is narrower. It describes where your data physically sits. A server in Amsterdam gives you EU data residency. On its own, it does not guarantee data sovereignty.
The gap between the two is where most of the confusion lives. If your data is stored in an EU data centre but the company running it is subject to foreign laws that can compel it to hand over data wherever it is stored, your residency is European while your sovereignty is less clear. The US CLOUD Act is the best-known example. Location is the starting point; who controls the infrastructure, and which laws apply to them, is the rest of the picture.
Data Sovereignty VS Data Residency: Quick Answers
Are they the same thing? No. Residency is about physical location. Sovereignty is about which laws govern the data and who can legally access it.
Can you have EU data residency without data sovereignty? Yes. Data stored in the EU by a provider subject to non-EU access laws has EU residency, but its sovereignty depends on those laws too.
Does GDPR require either one? Not in so many words. GDPR does not ban storing data outside the EU. It regulates transfers, and keeping data in the EU with an EU-based provider is the simplest way to keep those rules from becoming your problem.
Why server location is a compliance question, not just a performance one
For years, server location was mostly a performance conversation. If your customers are in Europe, a European server means lower latency and faster pages. That is still true, but it is no longer the whole story.
Under Chapter V of GDPR, any movement of personal data outside the European Economic Area counts as a transfer, and every transfer needs a legal basis. That might be an adequacy decision, where the European Commission has recognized a country’s data protection as equivalent, or Standard Contractual Clauses backed by a Transfer Impact Assessment. A transfer does not even require exporting a database: if someone outside the EEA can remotely access personal data on an EU server, that access can count too.
The TikTok decision shows why this matters. The Irish Data Protection Commission found the company had not verified that its contractual safeguards actually protected EEA user data from access under Chinese law, even though it had prepared transfer risk assessments and invested heavily in data security. The lesson for smaller businesses is not about TikTok’s scale. It is that paperwork alone does not solve a transfer problem when the legal environment on the other end works against it.
Regulators are also asking for more precision. Generic entries like “US cloud providers” in your records are increasingly treated as insufficient, and your supply chain counts: in the second quarter of 2026, DPD Polska was fined €2.68 million for not having data processing agreements in place with its subcontractors.
The practical consequence is simple. When your data is stored in the EU, or in a country with an adequacy decision, with a provider that is not subject to conflicting foreign access laws, a whole layer of transfer documentation gets much lighter. Fewer Transfer Impact Assessments, simpler records of processing, and shorter, more confident answers in client questionnaires.
If you read our piece on NIS2 and stricter EU domain validation, this will feel familiar. EU regulation is steadily moving from “have a policy” to “prove where things are and who controls them”.
What the AI Act Adds for AI-djacent Workloads
If you host anything that touches AI, such as a support chatbot, a recommendation engine, a model fine-tuned on your own data, or internal tools built on third-party models, the AI Act adds a second layer on top of GDPR.
The timeline shifted this summer. The Digital Omnibus on AI, published as Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved obligations for standalone high-risk AI systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. What it did not move matters just as much: the Article 50 transparency obligations still apply from August 2026, and the bans on prohibited practices and the rules for general-purpose AI models were already in force.
The AI Act does not tell you where to put your servers. What it does is ask for things that depend on your infrastructure: automatic event logging and retained logs for high-risk systems, documented governance of training and testing data, technical documentation and human oversight. If you cannot say where your logs and datasets live and who can access them, demonstrating compliance becomes much harder.
There is also the overlap. Most AI workloads process personal data somewhere, whether in training data, prompts, or outputs, so GDPR’s transfer rules apply alongside the AI Act. Hosting in the EU does not make you AI Act compliant on its own, but it removes one of the more complicated variables.
And a deferral is not a cancellation. Once you factor in procurement cycles, migrations and documentation work, December 2027 is closer than it looks.
What to Check Before Choosing a Provider
Whether you are reviewing your current setup or comparing providers, a few questions will tell you most of what you need to know.
Data center location, specifically. “Europe” is not an answer. Ask which country and which facility, and check that backups and failover sites sit in the same jurisdiction as your primary data.
Who controls the infrastructure. Ask where the provider is headquartered and whether it, or its parent company, is subject to non-EU laws that could compel access to your data. This is the sovereignty question that residency alone does not answer.
ISO certifications. ISO 27001 shows a certified information security management system; ISO 9001 covers quality management and process consistency. Ask for the certificates and check their scope, because a certification covering one office rather than the data centres you will use tells you very little.
Sub-processor transparency. A trustworthy provider publishes its sub-processors, says where each one is located, and notifies you before adding new ones. This is exactly the list your own clients and auditors will ask you for.
Where support access comes from. Remote access from outside the EEA can count as a transfer, so ask where the people who can reach your servers are based.
None of this requires a legal team to evaluate. It requires a provider willing to give you straight answers.
Where AltusHost Fits
AltusHost operates infrastructure in data centres in the Netherlands, Bulgaria, Sweden and Switzerland. The first three are EU member states, and Switzerland holds an EU adequacy decision, so personal data can move between Switzerland and the EU without additional transfer mechanisms. You choose the location, and you know exactly which country your data lives in.
We are a European company, and our operations are certified to ISO 9001 and ISO 27001, so our quality and information security management are independently audited rather than simply described on a website. That gives you something concrete to point to the next time a client or auditor asks where your data is and how it is protected.
Whether you run a handful of client sites, a business application on a VPS, or AI-adjacent workloads on dedicated hardware, the principle is the same: know where your data sits, know who controls it, and make sure both answers hold up under scrutiny.
The Bottom Line
Server location used to be a line in a technical spec. In 2026 it is a compliance decision, shaped by GDPR’s transfer rules, closer scrutiny of who can actually access data, and an AI Act timeline that is delayed but very much still coming. Data residency tells you where your data is. Data sovereignty tells you whose rules it lives under. Getting both right starts with a provider that can answer both questions clearly.
If you are not sure how your current setup would look to an auditor, we are happy to take a look and give you an honest answer either way.
The AltusHost Team
FAQ
Q: What does EU data residency mean for hosting?
EU data residency means your data, including backups and replicas, is physically stored in data centres within the European Union. For hosting, it means choosing a provider that lets you select specific EU locations and can confirm your data stays there. Residency covers location only; it does not by itself determine which laws govern access to the data.
Q: Why does server location matter for GDPR compliance?
GDPR treats any movement of personal data outside the European Economic Area, including remote access from outside it, as a transfer that needs a legal basis and often a Transfer Impact Assessment. Hosting in the EU, or in a country with an EU adequacy decision, with a provider not subject to conflicting foreign access laws, significantly reduces that burden and your exposure to transfer-related enforcement.
Q: What is the difference between data sovereignty and data residency?
Data residency is where your data is physically stored. Data sovereignty is which country’s laws govern that data and who can legally compel access to it. You can have EU residency without full sovereignty if your provider is subject to non-EU laws, which is why it is worth checking both the data centre location and who controls the infrastructure.