Data location and transfers

The region of a vendor is the country or area where it processes the personal data you give it. Your privacy policy must say when data leaves the European Economic Area (EEA) and how that transfer is protected.

#Where to find the region

Each vendor has a short Where do I find it? guide that tells you where to look in the vendor's own console or settings, what the usual region is and a link to open it. The guide is guidance only: it is never written into your record on its own, and every "usual" statement is a hint to verify in your own account.

For tools that keep data in a single place for every customer, the standard region is prefilled and you can change it if your setup differs.

#Why Privacyboard never guesses

A region depends on how you configured the tool, for example the region you picked when creating a project. A wrong region in a public document is worse than an empty one, so the region is requested rather than assumed.

#Transfers outside the EEA

When a vendor's region is outside the EEA, Privacyboard flags it. Your privacy policy and data processing agreement then ask how the transfer is protected. The usual bases are:

• An adequacy decision for the destination country.
• Standard contractual clauses.
• The EU–US Data Privacy Framework, for certified US providers.

Articles 44 to 49 of the GDPR set the rules. Check the vendor's own agreement for the mechanism it relies on.

#FAQ

#What counts as outside the EEA?

Anywhere other than the EU member states plus Iceland, Liechtenstein and Norway.

#Is a US region always a problem?

No. It is a transfer that needs a documented basis. Many US providers certify under the EU–US Data Privacy Framework or offer standard contractual clauses.

#What if a vendor processes data in several regions?

Record the regions that apply, and explain in the notes.