GDPR AI hosting: an EU data-residency checklist

No hosting provider or AI platform is GDPR compliant on its own: the GDPR governs how you process personal data, and a provider can only give you the region, contract and controls to do it lawfully. For AI hosting, check where every copy of the data is processed, including backups, logs, failover and support access; which legal entity and parent company operate the service; whether you get an Article 28 data processing agreement with a sub-processor list and change notices; how any transfer outside the EEA is covered; and whether prompts and outputs are retained or used for training. An open-weight model on infrastructure you control in an EU region keeps the number of parties that touch the data small.

• No platform is GDPR compliant by itself; the contract and how you process the data decide.
• Region: compute, storage, backups, logs and failover in the EU or EEA; the UK and Switzerland are transfers.
• Contract: an Article 28 DPA, a sub-processor list with change notices, deletion at the end.
• Jurisdiction: an EU operator and a provider under US law carry different disclosure risks.
• Isolation: dedicated hardware, your own keys and private networks limit who can reach the data.

The GDPR governs how personal data is processed, not which products may be used. When you run a model on prompts, documents or logs that contain personal data, you usually decide why and how that data is processed, and the hosting provider processes it on your behalf. That makes the provider a processor under Article 28, which sets the contract terms and guarantees you must get from it [1]. A provider can offer the region, the contract and the controls you need; whether your setup complies depends on how you use them.

That is why “GDPR compliant” on a product page is a claim to check rather than an answer. The rest of this checklist turns it into questions with verifiable answers: where the data goes, who operates the service, what the contract says and who else can reach the data.

The AI Act is a separate set of rules

The EU AI Act sets risk-based rules for developers and deployers of AI systems. It entered into force on 1 August 2024. The bans on prohibited practices and the AI-literacy duty have applied since 2 February 2025, the rules for general-purpose AI models since 2 August 2025, and most other rules since 2 August 2026, with exceptions: rules for high-risk uses in sensitive areas apply from 2 December 2027 and those for AI built into regulated products from 2 August 2028, following the “AI Omnibus” amendments that entered into force on 27 July 2026  [2]. The questions below are about data protection; the AI Act adds obligations that depend on what your AI system is used for.

Data residency describes where data is stored and processed. It does not, on its own, decide who can be compelled to hand it over, or whether a transfer outside the EU is lawful. Three rules shape the answer.

• Transfers need a legal basis. The GDPR does not require data to stay in the EU, but any transfer to a third country “shall take place only if” the conditions of its Chapter V are met, including for onward transfers (Article 44) [1].
• US law follows the provider, not the data centre. Since the CLOUD Act, a provider of electronic communication or remote computing services must meet its US obligations to preserve or disclose customer data within its “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. § 2713) [3]. An EU region operated by a company under US jurisdiction is therefore a different risk profile from the same region operated by an EU company.
• The EU-US Data Privacy Framework is valid, and under appeal. The Commission adopted the adequacy decision on 10 July 2023, and it covers only US companies that participate in the framework [4]. The General Court dismissed an annulment action on 3 September 2025 (T-553/23, Latombe v Commission), and an appeal is pending before the Court of Justice as C-703/25 P [5]. Transfers that rely on it can change if the Court rules otherwise.

A region sold as “European” can sit in four different legal situations, and they are worth keeping apart when you read a region list:

Adequacy decisions are reviewed periodically and can be amended or withdrawn [4], which is why a region inside the EU or EEA is the simpler choice when the data is sensitive. The table in the next section keeps these locations apart for every provider in our dataset.

Choosing an EU region is the first step, not the last. For each service in the stack, check where each copy of the data ends up:

• compute and primary storage: the region you select;
• backups and snapshots: often a separate setting, sometimes a separate region;
• failover and disaster recovery: where a service moves your workload or data when a region fails;
• logs, metrics and traces: request logs can contain prompts, and monitoring may run elsewhere;
• support access: whether engineers outside the EU can reach your systems, and under what controls;
• model endpoints: a hosted model API processes prompts wherever the model provider runs it.

The providers in our dataset that list at least one region in the EU or the rest of the EEA:

The table shows what each provider documents; it cannot show which of its services your workload will actually use. Confirm the region, the processor terms and the sub-processors for each service before you move personal data, and use the private AI hosting comparison to narrow the list. For GPU workloads, the GPU cloud comparison can be filtered to providers with EU regions.

Article 28 of the GDPR sets the minimum terms between you and a hosting provider that processes personal data for you [1]:

• You may use only processors “providing sufficient guarantees” to implement appropriate technical and organisational measures.
• The processor “shall not engage another processor without prior specific or general written authorisation”, and with a general authorisation it must tell you about added or replaced sub-processors so you can object.
• Processing is governed by a contract that sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

What the data processing agreement must say

If data does leave the EEA to a country without an adequacy decision, Article 46 requires appropriate safeguards, such as standard data protection clauses adopted by the Commission or binding corporate rules [1]. Ask which mechanism the provider relies on for each sub-processor outside the EEA.

Fewer parties touching the data means fewer contracts to check and fewer places a leak can start. The options range from shared to fully dedicated:

• Encryption keys: find out whether keys are managed by the provider or by you, and who can access them.
• Network: keep model servers on private networks and admin interfaces off the public internet.
• Prompts and outputs: for managed APIs, read how long prompts are retained and whether they may be used for training; for self-hosted models, your own logging decides.

Running an open-weight model on a server you control in an EU region keeps prompts inside your own environment. The VRAM guide sizes the GPU; for an agent or a small model on a CPU server, compare AI VPS plans, and the agent hosting guide covers the always-on setup.

Marketing claims and certificates show intent and controls; neither shows that your use of a service is compliant. Ask for the evidence behind each claim:

Germany's BSI publishes the C5 catalogue, which “specifies minimum requirements for secure cloud computing”. The BSI advises customers to obtain the provider's C5 report, analyse it and repeat that yearly, and notes that it does not select the auditors or check the audit reports itself [8]. The same reading applies to ISO/IEC 27001 certificates and SOC 2 reports:

• Is the service you will use, in the region you will use, inside the scope?
• How old is the report or certificate, and when is the next audit?
• Which controls remain your responsibility under the shared-responsibility model?

Ask each shortlisted provider, in writing:

1. Which legal entity signs the contract, in which country, and who is the parent company?
2. Which EU or EEA regions run the exact services and GPU types we need?
3. Where are backups, snapshots, logs and monitoring data stored, and where does failover run?
4. Can staff or sub-processors outside the EEA access our data, and under which safeguards?
5. Where is your Article 28 DPA, and where is the current sub-processor list?
6. How much notice do you give before adding a sub-processor?
7. How long are prompts, outputs and logs kept, and are they ever used to train models?
8. Is the hardware dedicated to us, and who manages the encryption keys?
9. How do you respond to foreign government requests for customer data?
10. Which audit reports or certificates cover these services and regions, and how recent are they?
11. How is our data deleted or returned when the contract ends?

Then compare the providers that pass on the private AI hosting page, and use the Agent Hosting Selector to match the hosting type to your workload.