Start a project
Start a project Book a call
Compliance

Where to host your site and data for customers in the EU, UK, US and Canada: location and transfer rules

Where your site is hosted is only part of the picture. This guide separates hosting location from data transfer rules for the EU, UK, US and Canada, as official pages showed them on 5 November 2026, with a decision list and provider questions.

ESTASOFT
12 min read
Cobalt blue cover with three white server bars and a yellow map pin, with the title Where your data and site should live
On this page
    On this page

      Your customers are in more than one of the EU, the UK, the US and Canada, and someone tells you to host in the EU, or to keep data in Canada. The place a server stands is only part of the question. Transfer rules also look at who can see personal data, from where, and through which suppliers.

      This article separates hosting location from data transfers, summarises what official pages for each place said on 5 November 2026, shows how to read a provider's region list, and ends with a decision list and provider questions. Rules and court cases change, so use it as a map for questions to an adviser.

      Hosting location and data transfers are different questions

      Personal data sits in more places than your main server: backups and logs, a CDN's copies, the email, analytics, chat and payment tools around your site, and people who can open your systems from other countries, such as support staff, developers and agencies.

      Official pages define a transfer by what happens to the data, not by where one server stands. The UK Information Commissioner's Office (ICO) says an international transfer includes sending personal information to a separate organisation outside the UK and making it accessible to one, and it gives remote access as an example. The European Data Protection Board (EDPB) says a transfer happens when a sender subject to the GDPR makes personal data available to an organisation outside the European Economic Area (EEA). The EDPB page does not name cloud services or remote access, so ask an adviser how it applies to yours.

      The ICO's quick reference FAQs say using a UK-based cloud provider is not a restricted transfer, and using one based outside the UK is very likely one. Sending data to an employee of the same organisation abroad is not a restricted transfer, though security still applies. The ICO says this guidance has been under review since the Data (Use and Access) Act became law on 19 June 2025, and that no country is off limits if you follow the rules and assess the risks.

      What official pages say about moving data between the four places

      Each place differs. Every point below comes from a page named under Sources.

      • From the EU. The European Commission says that where it has adopted an adequacy decision, personal data can move from the EU, Norway, Liechtenstein and Iceland to that country without further safeguards. Its list includes Canada (commercial organisations), the UK (two decisions renewed on 19 December 2025) and the US for organisations that take part in the EU-US Data Privacy Framework.
      • From the UK. The ICO's adequacy page lists the EU and EEA countries as fully covered. Canada is covered only for information subject to PIPEDA, the federal law for private-sector commercial activity. The US is covered only under the UK Extension to the Data Privacy Framework, the UK-US data bridge. The ICO says US recipients must be regulated by the Federal Trade Commission or the Department of Transportation, self-certify to the US Department of Commerce and renew each year. Check that the recipient is active, covers the UK Extension and covers your type of data.
      • From Canada. The federal Office of the Privacy Commissioner's guidelines, dated 27 January 2009, say a transfer to a processor is a use, not a disclosure. The organisation stays responsible, contracts are the main tool for comparable protection, and people should be told, ideally at collection, that their data may be processed abroad and reached by that country's authorities. These guidelines are old. Check the Commissioner's current pages for newer guidance.
      • Quebec. Provincial law can add rules. The Légis Québec page for section 17 of Quebec's private sector privacy Act shows a current version in force since 22 September 2023. It requires a privacy impact assessment before a business communicates personal information outside Quebec, and allows it only if the information would be adequately protected, under a written agreement that reflects the assessment. The same applies when you entrust someone outside Quebec to handle information for you. The section has an exception that refers to section 18, so ask a Quebec adviser. We opened no page on other provinces.
      • The US. We opened no official US page on this topic, so we state no US rule. Ask your adviser which federal, state and sector rules cover your customers' data, and whether any of them limits sending it abroad.

      When there is no adequacy route

      Where there is no adequacy decision, the EDPB lists other tools: standard contractual clauses (SCCs), binding corporate rules, codes of conduct, certification and approved ad hoc clauses. It says SCCs call for a transfer impact assessment and treats exceptions such as explicit consent as a last resort. The Commission issued the modernised SCCs on 4 June 2021.

      The UK has its own contracts: the International Data Transfer Agreement (IDTA), and an Addendum that attaches to the EU SCCs. Relying on one means completing a transfer risk assessment first, which UK legislation now calls the data protection test. The ICO says its current templates were laid before Parliament on 2 February 2022 and that it plans to update both in 2026, so check for new versions.

      The EU-US framework and the court case

      The Commission adopted the EU-US Data Privacy Framework adequacy decision on 10 July 2023. On 3 September 2025 the EU's General Court dismissed an action to annul it (case T-553/23, Latombe v Commission), finding that the US ensured adequate protection on the day of adoption. The Court added that the Commission must keep monitoring US law and may suspend, amend or repeal the decision if that law changes. An Official Journal notice shows an appeal to the Court of Justice, case C-703/25 P, brought on 31 October 2025. We could not open a page showing its current status, so check the Court's case page, and ask your adviser whether you need a fallback contract such as SCCs.

      How to read a provider's region list

      A hosting region is a place where a provider runs servers for your site. Our article on hosting regions for Gulf customers gives the reading steps, and our cloud and hosting page describes the service we offer. Microsoft's Azure region list (footer date 13 October 2026) shows what to look for. We did not open the AWS or Google Cloud lists, so read theirs the same way.

      • Country and city. The page lists Canada Central (Toronto), Canada East (Quebec), UK South (London), East US (Virginia), Germany West Central (Frankfurt) and North Europe (Ireland).
      • Europe is not the EU. The page uses no EU label. Its geography names include Europe (North Europe, West Europe) and countries such as the United Kingdom, Norway and Switzerland. Choose by country and city.
      • Restricted and preview regions. Icons mark restricted-access and preview regions. Plan around what you can use today.
      • Paired regions. The page lists pairs: Canada Central with Canada East, UK South with UK West, and East US with West US. Ask whether your backups or failover copies go to the pair, and where it is.
      • Zones and services. The page warns that a region with zones does not mean every service supports them.

      When the platform picks the location

      On a hosted platform you may not choose a region. Shopify's Help Center says new merchants in Europe get store, order and customer data stored at rest in Europe by default, that it rebalances storage between Google Cloud regions and moves data geographically, and that it relies on international transfers to process data. The page mentions no merchant choice and shows no date. Ask any platform in writing where your data sits and who can reach it. See also our article on privacy and cookies for a Shopify store.

      CDN and caching: the other half of speed

      MDN Web Docs describe a content delivery network (CDN) as a group of servers in many places holding copies of data, so a nearby server can answer a request. MDN lists lower latency and less load on your servers as benefits, and third-party dependence, an extra attack route and extra connections as costs (page last modified 11 July 2025). A CDN is also a supplier, so it belongs on your transfer map. Ask what it stores, for how long, whether carts and accounts stay out of the cache, and where its logs go.

      A decision list

      1. List where your customers live and which personal data you collect: accounts, orders, forms, support messages.
      2. List every system that holds that data (site, database, backups, logs, CDN, email, analytics, payments), its country or city, and who can reach it from outside that region.
      3. For each flow that leaves a place, ask your adviser which route applies: an adequacy decision, the Data Privacy Framework or UK Extension (with the recipient's status checked), SCCs or the UK IDTA or Addendum, or a Quebec assessment.
      4. Choose a main region with your adviser, weighing where your largest customer group is against the transfer routes above. Add a second region or a CDN only if tests from other markets show a need.
      5. Check that backups and logs follow the same location rule as the live site.
      6. Keep a dated record of the pages you read and the providers' written answers. Read the pages again before renewals and after any court or regulator change.

      Questions for a hosting provider

      The Canadian Centre for Cyber Security (February 2024) tells small organisations to get to know a cloud or outsourced provider before contracting and to know where its data centres are. The US Federal Trade Commission's small business cybersecurity page has a topic on hiring a web host. Ask in writing:

      • In which country and city do my live data, backups and logs sit, and can I choose?
      • Can your staff or subcontractors reach my data from other countries, and why?
      • Which subprocessors do you use, where are they, and how will you tell me about changes?
      • If you are a US company, are you active on the Data Privacy Framework list, for which data types?
      • Which transfer contracts do you offer: SCCs, the UK Addendum, the IDTA?
      • What happens to my data if you move it to another region?
      • How do I export and delete my data when I leave, and how long do backups keep it?

      If you build software, business buyers will ask you these questions too. See our article on building a SaaS product for US and EU customers.

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      ESTASOFT can help with cloud and hosting: send a short brief on the contact page. For how domains, DNS and hosting fit together, read domains, DNS and hosting explained.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.