Guides for deciding where personal data can be hosted and who can access it: EU residency, US cloud providers, transfer impact assessments and remote support from outside the EEA.
Whether the GDPR requires keeping data in the EU: why it regulates transfers rather than storage location, what counts as a transfer, adequacy and other tools, and when keeping data and administration inside the EEA removes transfer work.
What it takes to use a US-headquartered cloud or SaaS provider under GDPR: DPF certification, SCCs and the transfer assessment, foreign authority requests and Article 48, EU-hosted services still subject to US law, and where encryption helps or does not.
How to carry out the transfer assessment the EDPB and the 2021 SCCs expect: the six steps, assessing third-country law and practice, when supplementary measures are needed, the encryption use cases, and re-evaluation.
Why vendor support or administration from a third country is a transfer even without copying data, the EDPB examples, contract modules and instructions that cover it, and design options such as EEA-only administration and key control.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.