GDPR data residency has no fixed storage rule. UK GDPR lets your Microsoft 365 backup be stored almost anywhere, provided every transfer has a lawful mechanism you can document. Most backup contracts can’t show one for each flow.
A UK region on the order form can hide an overseas replica, a support engineer abroad and a parent company answerable to a foreign court. Your organisation is accountable for each of those transfers.
The seven questions below will expose them before you sign.
Key Takeaways for CTOs on Backup Data Residency
- Storing backups outside the UK is lawful when each transfer has a valid mechanism.
- A region setting covers storage only. Replicas, logs, support access and sub-processors each need their own answer.
- Vendor staff opening your data from abroad counts as a transfer, even when the data stays in the UK.
- US-owned vendors fall under the CLOUD Act in any region. Customer-held encryption keys are the strongest defence.
- Seven written answers from the vendor will show whether its residency claim holds.
Does UK GDPR Require Data to Be Stored in the UK?
No. UK GDPR and EU GDPR set no required storage country. Both regulate how personal data crosses borders.
Hard residency rules usually come from four other sources:
- Sector regulators, such as those in financial services and health
- Public sector contracts
- Customer agreements
- Internal policy
Procurement tip: When a tender cites a “GDPR residency requirement”, ask which article it refers to. If no one can name one, the rule comes from policy or contract, and its scope is open to discussion.
UK GDPR Chapter V: The Rules on International Data Transfers
Chapter V of the UK GDPR, as amended by the Data (Use and Access) Act 2025, governs transfers outside the UK.
Each transfer needs adequacy regulations (the UK equivalent of an EU adequacy decision) or an appropriate safeguard, such as the International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) with the UK Addendum.
A third route, exceptions, covers only occasional or specific transfers. Backup copies data every day, so it depends on the first two.
Data Residency vs Data Sovereignty vs Data Localisation
| Term | What It Means | Question to Raise |
| Data residency | Where data is physically stored | Which regions hold every copy? |
| Data sovereignty | Whose laws can compel access to it | Where is the vendor’s parent company incorporated? |
| Data localisation | A legal duty to keep data in one country | Does a regulator in your sector require it? |
A vendor can offer residency without sovereignty. For backup buyers, that gap matters more than any region dropdown.
Why Microsoft 365 Backups Create More Data Transfer Risk
Backups hold more data, for longer, in more places. A single backup tenant can contain years of email, files and chat, including content users deleted from production long ago.
The vendor then adds data flows production never creates. Each one needs a known location and a legal basis:
- Replicas: copies kept for resilience, sometimes in a second region.
- Restores: data routed back through vendor infrastructure.
- Indexing: services that read content to power granular search.
- Metadata and logs: names, email addresses and file titles, often stored centrally.
- Support access: engineers viewing data while troubleshooting.
If a vendor can only name its primary storage location, it has answered one question in five.
Under Microsoft’s shared responsibility model, protecting Microsoft 365 data is already your job. Adding a backup vendor stretches that job to every location the vendor sends your data.
Which GDPR Transfer Mechanisms Apply to Backup Data?
Every backup flow leaving the UK relies on one of two mechanisms: adequacy or a contract. Each has a weak point worth testing.
Adequacy Decisions and the EU-US Data Privacy Framework
Adequacy allows data to move without additional safeguards. Three routes apply to most UK buyers:
- UK and EEA: mutual recognition, so data moves freely in both directions. The EU renewed its UK adequacy decisions in December 2025, and they now run to 27 December 2031.
- EU data to the US: the EU-US Data Privacy Framework (DPF), open only to self-certified organisations.
- UK data to the US: the UK Extension to the DPF, also called the UK-US data bridge, for certified organisations that have opted in.
Verification tip: Search for the vendor on the official Data Privacy Framework List. Confirm that the entity named in your contract is certified, that its certification is active and that the UK Extension is included.
Weak point: The DPF’s predecessors, Safe Harbour and Privacy Shield, were both struck down. The EU General Court upheld the current framework in September 2025, and that ruling now faces an appeal at the Court of Justice. Any US-linked vendor should be able to name its fallback mechanism.
Standard Contractual Clauses, the IDTA and the UK Addendum
Contracts cover transfers that adequacy cannot reach. EU data moves under the European Commission’s Standard Contractual Clauses. UK data moves under the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
Weak point: Coverage often stops at the vendor. Module 2 of the EU SCCs covers your transfer to the vendor, while onward transfers to its sub-processors need Module 3 or an equivalent safeguard. Ask to see both.
Transfer Risk Assessments Under the Data (Use and Access) Act
A signed contract starts the process. You must also assess the laws of the destination country. EU transfers on SCCs need a transfer impact assessment. UK transfers must pass the data protection test introduced by the Data (Use and Access) Act 2025: protection abroad must not be materially lower than in the UK.
The ICO’s January 2026 transfer guidance still calls this a transfer risk assessment (TRA) and focuses it on two risks: public authority access and whether people can enforce their rights.
Weak point: A vendor’s assessment reflects its own view of risk. As controller, you still need yours.
Does Remote Access Count as a Data Transfer Under UK GDPR?
Data can stay in a UK data centre and still be transferred. The ICO’s January 2026 guidance treats making data available to a separate organisation abroad, including by remote access, as a restricted transfer.
The European Data Protection Board takes the same view in Guidelines 05/2021. Your own employees working abroad fall outside this rule. A vendor’s support desk on another continent falls inside it and needs its own mechanism.
Which GDPR Transfer Route Applies to Your Backup?
Can a US Backup Vendor Be GDPR Compliant Under the CLOUD Act?
Yes, provided the right safeguards are in place. A UK region alone will not supply them.
The US CLOUD Act of 2018 lets US authorities compel US providers to disclose data in their possession, custody or control, wherever it is stored. A UK region from a US-headquartered vendor improves latency and simplifies paperwork. The legal reach stays the same.
4 Controls That Limit CLOUD Act Exposure
1. Customer-held encryption keys. If the vendor cannot decrypt your data, a disclosure order yields only unreadable ciphertext. The keys must stay in a key vault or hardware security module (HSM) you control. Keys held in the vendor’s own key management service still give it the means to decrypt.
2. Corporate structure. Check which entity signs your contract: a UK or EU company, a US parent, or one of its subsidiaries. US ownership of the group can extend the Act’s reach to data its subsidiaries hold.
3. Request-handling commitments. Look for contract terms that oblige the vendor to challenge overbroad orders and notify you where the law allows.
4. Transparency reports. Published figures on government requests show how often the vendor receives them and how it responds.
DORA, NIS2 and Other Rules That Affect Backup Data Location
GDPR sets the baseline. Depending on your sector and footprint, one of these may set the real terms of your backup contract.
PRA-regulated firm? Supervisory Statement SS2/21 expects you to weigh data location and access when outsourcing, and backup counts.
EU financial entities in the group? DORA, in force since 17 January 2025, requires contracts to specify where data is processed and stored and to include a documented exit strategy. UK groups fall in scope through their EU subsidiaries.
Essential or important services in the EU? NIS2 requires supply chain security, and backup providers form part of that chain.
Planning to switch providers? Since 12 September 2025, the EU Data Act has required cloud providers serving EU customers to support switching. From 12 January 2027, they can no longer charge switching fees, which strengthens your hand in exit negotiations.
Handling NHS patient data? The Data Security and Protection Toolkit sets mandatory standards for NHS organisations and the suppliers that access their data.
Map these before shortlisting. They can rule a vendor out faster than GDPR will.
Key Dates for Backup Residency Decisions
7 Data Residency Questions to Ask a Backup Vendor
Put these to every vendor in writing. Each one comes with the answer worth holding out for.
- Where Is Every Copy Stored?
Headline regions often describe primary storage only.
Strong answer: A named region for primary, replica and disaster recovery copies, plus search indexes, metadata and logs, all guaranteed in the contract.
- Who Are Your Sub-Processors, and Where Are They Based?
Article 28 requires your authorisation before a processor appoints sub-processors.
Strong answer: A full list with countries, shared before signing, plus advance notice of changes and a right to object.
- Where Can Support Staff Access Data From?
A support engineer abroad opening your backup creates a restricted transfer, even if the data never leaves the UK.
Strong answer: Named countries, access only with your approval, and a log of every session.
- Who Holds the Encryption Keys?
Encryption at rest and in transit is standard. Control over the keys is what separates vendors.
Strong answer: Customer-managed keys you can rotate or revoke without raising a support ticket.
- What Does the DPA Say About Location?
Trust pages and sales decks can change without notice. Only the data processing agreement binds the vendor.
Strong answer: Storage locations and the transfer mechanism for each data flow, written into the data processing agreement.
- How Is Data Deleted at Exit?
Article 28 requires deletion or return of data when the service ends.
Strong answer: A fixed deletion timeline, a standard export format and written confirmation that every replica is erased.
- Which Certifications and Audit Rights Back This Up?
ISO 27001, SOC 2 Type II and Cyber Essentials Plus show security maturity. ISO/IEC 27018, the code of practice for protecting personal data in public clouds, comes closer to privacy. None of them shows where data travels.
Strong answer: Current certificates plus a contractual right to audit, or to receive independent audit reports.
Residency is one part of vendor selection. For recovery speed, retention and pricing, work through the 10-point backup provider checklist.
Controller vs Processor: Who Owns Each Residency Task
8 Red Flags in Backup Vendor Data Residency Claims
Residency gaps usually show up in vendor phrasing long before an audit finds them. Translate these before you sign.
- “EU hosted”: Storage may be in the EU while support teams work from third countries.
- “Available on request”: The sub-processor list may only arrive under NDA or after signing.
- “Your data stays in-region”: Logs, telemetry and metadata are often excluded.
- “Geo-redundant by default”: Secondary replicas may land in another jurisdiction.
- “May process globally”: The DPA leaves room for transfers you never approved.
- “Data Privacy Framework certified”: The certification may cover only the US parent, or leave out the UK Extension.
- “Fully GDPR compliant”: Ask for the transfer risk assessment. If none exists, the claim is unsupported.
- A region dropdown on the pricing page: Check the contract. If the region is missing there, the vendor has made no binding commitment.
One red flag calls for a follow-up question. Two or more call for a different vendor.
3 Steps to Build Data Residency Into Microsoft 365 Backup
Architecture decides where backup data actually goes, so build residency in at the design stage. Three steps cover most setups.
Step 1: Mirror your tenant’s geography. If your Microsoft 365 tenant uses Multi-Geo, map each geography to a matching backup region. Data from different jurisdictions then stays separate from capture to restore.
Step 2: Decide who owns the storage. Vendor-managed storage is simpler to run. Owning the storage layer gives you direct control over region and provider. Recoverable’s Enterprise plan supports bring-your-own storage for teams that want that control.
Step 3: Set review triggers. An annual review is the minimum. Re-check the setup sooner when any of these happen:
- The vendor adds or changes a sub-processor
- Your tenant adds a new geography
- A merger or acquisition brings in new data
- The Court of Justice rules on the DPF appeal, or an adequacy decision changes
- The vendor is acquired or changes ownership
How to Act on GDPR Data Residency This Week
Every residency claim comes down to three answers: where the data is stored, who can reach it and from where, and which mechanism covers each flow. A vendor that puts all three in writing, backed by the contract, gives you a position you can defend to auditors, regulators and the board.
This week: Send the seven questions to every vendor on your shortlist and compare the written answers side by side.
Then: See how Recoverable’s Microsoft 365 backup handles residency in practice, with EU-based data centres that UK GDPR recognises as adequate, bring-your-own storage on the Enterprise plan and ISO 27001 certification. Test it in your own environment with a 30-day free trial, no credit card required.
GDPR Data Residency: Frequently Asked Questions
Where does Microsoft store Microsoft 365 data for UK organisations?
Microsoft runs a UK data centre region for core Microsoft 365 data, and tenants with a UK billing address are normally provisioned there.
Tenants created before the UK region opened in 2016 may still be held in the wider European geography. A global admin can check the current location on the Data Location card in the Microsoft 365 admin centre. Organisations that need a contractual commitment to UK storage can buy the Advanced Data Residency add-on, which also covers Microsoft 365 Copilot. Microsoft’s storage location tells you nothing about your backup. Check your backup vendor’s region, replicas and support access separately.
What are the fines for breaking GDPR data transfer rules?
Breaches of GDPR’s international transfer rules fall into the higher tier of fines. Under EU GDPR, that means up to €20 million or 4% of worldwide annual turnover, whichever is higher. UK GDPR sets the cap at £17.5 million or 4%. These are maximums, and regulators weigh factors such as intent, duration and cooperation.
One of the largest GDPR fines on record was a transfer case: in 2023, the Irish Data Protection Commission fined Meta €1.2 billion over EU-US data flows. Regulators can also order transfers to stop. For a backup service, that could mean losing protection until a compliant setup is in place.
Does the right to erasure apply to backup data?
Yes. The right to erasure covers personal data in backups as well as in live systems.
The ICO accepts that deleting one person’s data from a backup may not be possible straight away. In that case, the ICO expects the data to be put beyond use. No one may access or use it for decision-making; it must remain secure and be deleted when the backup expires or is overwritten. You should also tell the individual what will happen and when. Before signing with a vendor, ask whether it can delete individual items across all backup versions. This makes erasure requests far simpler to fulfil.
How long can backup data be kept under GDPR?
GDPR sets no fixed retention period for backups. Under the storage limitation principle, personal data can be kept only as long as its purpose requires. For backups, that purpose is usually recovery, along with legal and regulatory duties.
HMRC, for example, requires companies to keep accounting records for six years from the end of the financial year they relate to. Set a written retention schedule that ties each period to a reason, then apply it in the backup tool. Long retention is defensible when the reason is documented, such as a litigation hold or a sector record-keeping rule.
Do privacy notices need to say where backup data is stored?
Yes, if backup data leaves the UK or EEA. Articles 13 and 14 of GDPR require privacy notices to state when personal data goes to a third country. They must also name the safeguard that covers the transfer and explain how people can obtain a copy of it.
Notices must list recipients or categories of recipients too, which includes service providers such as backup vendors. Employee privacy notices are often overlooked, even though staff mailboxes make up much of a Microsoft 365 backup. Review the notice whenever you change a vendor, storage region or sub-processor.