Recommended Free Tools
Choose a provider by tracing where the exact services store, process, back up and expose your data—not by picking a European region or relying on a “sovereign” label. Define the workload’s legal and operational requirements first, then compare provider evidence on data flows, access, transfer mechanisms, security, assurance, resilience, contracts and exit costs. A European hosting location can support a residency requirement, but it does not by itself make a workload GDPR-compliant.
Start with the workload’s requirements
Before comparing providers, write down what this workload must protect and what “European” or “resident” means for it. A requirement that personal data remain in the EEA at rest is different from a rule that also confines processing, backups, administrative access and support to a particular jurisdiction. The appropriate boundary depends on your organization, data and applicable rules; a cloud region alone does not settle it.
As an Amazon Associate I earn from qualifying purchases.
- Data and roles: Identify the data categories, whether personal or special-category data are involved, and which parties act as controller, processor or subprocessor.
- Rules: Record applicable GDPR obligations, national requirements and any sector-specific rules. Ask legal or privacy counsel to assess how they apply to this workload.
- Geography and access: Specify allowed locations for storage, processing, backups, support and administrative access. State whether access from outside the boundary is prohibited, restricted or allowed with safeguards.
- Security and recovery: Set requirements for encryption, control of keys, incident response, availability and recovery time and recovery point.
- Operations and exit: Include service availability, performance, migration needs, data deletion and return, and acceptable switching and egress costs.
These requirements become pass/fail conditions where necessary and weighted comparison criteria where trade-offs are acceptable.
Trace the full data and access path
For each shortlisted service—not just the provider’s general cloud platform—review its data-location documentation, service terms, privacy materials and subprocessor list. Map the data lifecycle from ingestion through routine operation, backup, support, maintenance and deletion. Check logs and telemetry, replication settings, regional dependencies and features that can move or expose data across boundaries.
#1 Best Overall
Ask specifically who can access customer data, from where, for what purpose and under what controls. Include provider personnel, support teams, subprocessors and maintenance operations in the inquiry. A region selection is not proof that every related operation stays there.
Amazon Web Services says that its EU Regions include France, Germany, Ireland, Italy, Spain and Sweden. AWS also says service maintenance or provision may involve transfers of customer data outside the selected Region and directs customers to service-specific privacy resources. This is an AWS-specific qualification, not evidence that every provider or service operates the same way. Obtain equivalent, current documentation for each exact service and configuration being considered.
Assess transfers by destination and mechanism
Where personal data may be transferred outside the applicable boundary, determine the destination, parties, purpose and legal mechanism for that specific flow. The European Commission’s overview of GDPR Article 45 explains that an adequacy decision permits covered personal data to flow to its destination without another transfer safeguard; adequacy decisions are periodically reviewed. The EDPB describes adequacy as a binding mechanism adopted by the Commission.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
Where there is no applicable adequacy decision, standard contractual clauses (SCCs) and supplementary measures may be relevant. AWS’s GDPR information describes SCCs as a transfer mechanism for destinations without an adequacy decision and points to EDPB recommendations on supplementary measures. Treat that as provider guidance, not a substitute for assessing the actual transfer and current official requirements.
For each transfer, verify the current status of the destination, the parties covered, the purpose and the safeguards in practice. A provider’s standard data processing agreement (DPA) may not resolve every question about a particular service, subprocessor or access path. The EDPB’s adequacy page lists an EU–U.S. Data Privacy Framework FAQ for European businesses dated 23 January 2026; check the current official FAQ and whether the relevant organization is covered before relying on that framework.
Read certifications and codes within their scope
Certifications, attestations and codes can help demonstrate controls, but none is a universal compliance stamp. The EU Cloud Code of Conduct is voluntary and describes guarantees cloud processors can provide, alongside ways for customers to assess services. EDPB Guidelines 07/2022 address certification specifically as a tool for transfers; they do not make any certification proof that a workload meets every applicable obligation.
Rank #3
For each assurance claim, request the current certificate or attestation and check:
- the issuing body or auditor, covered legal entity and included services;
- geographic scope, validity period, exceptions and exclusions;
- the controls actually assessed and how they map to your requirements;
- whether the evidence covers the configuration and service you intend to use.
AWS’s European Sovereign Cloud compliance page lists programs including C5, ISO 27001, ISO 27017, ISO 27018, ISO 27701 and SOC 2. AWS also states that customers remain responsible for compliance with applicable laws and programs. These are provider-specific statements, not a comparison with other providers or a determination that a particular workload complies.
The EU cybersecurity certification landscape also needs careful wording. In a letter dated 16 July 2024, the EDPB raised issues concerning the relationship between cybersecurity-risk and personal-data-protection risk assessments in ENISA’s EUCS work. The European Commission’s cloud policy page discusses that work and 2026 developments. Check current scheme status before treating EUCS as a final, available certification or as sufficient for a legal obligation.
Compare providers on evidence, not labels
Use the same questions and evidence standard for every provider. Mark each item as met, unmet or unverified; do not award a pass for a marketing statement where service-specific documentation or contractual commitments are needed.
| Criterion | Evidence to compare | Why it matters |
|---|---|---|
| Location and data flows | Locations for storage, processing, backup, replication, logging and telemetry for the exact service and configuration. | A named region may not describe every data operation. |
| Access and operations | Support and administrator access rules, maintenance model, personnel controls and subprocessor locations. | Data residency includes who can access data and how service operations work. |
| Transfers | Transfer destinations, applicable mechanism, parties, purpose and supplementary safeguards where needed. | The right mechanism depends on the actual destination and circumstances. |
| Security and privacy controls | Encryption options, key control, incident response, audit evidence and privacy controls relevant to the workload. | Controls must match the organization’s risks and obligations. |
| Assurance scope | Current certificates or attestations, covered entity and services, geography, validity and exceptions. | A program name does not establish coverage of the service being purchased. |
| Resilience | Availability and recovery commitments, backup design, dependencies and tested recovery arrangements. | Regional choices and dependencies can affect continuity and recovery. |
| Contract and lifecycle | DPA and service terms, deletion and return provisions, subprocessor notices, portability, migration effort and exit costs. | Contract rights and switching practicality affect control over the data throughout its life. |
| Operational and commercial fit | Required service availability, expected performance, operational autonomy and total cost for the workload. | A provider must meet practical workload needs as well as residency and compliance requirements. |
For high-priority obligations, use a pass/fail gate rather than allowing a strong score elsewhere to compensate for a missing control. For the remaining criteria, document the evidence behind each rating and weight it according to the workload’s risks. Obtain commitments in the contract where a requirement must be enforceable, rather than relying only on a sales answer.
Plan for portability and changing conditions
Switching deserves a place in the initial decision, not just the eventual exit plan. The European Commission’s 25 June 2026 announcement on its preliminary DMA position said AWS and Azure were the largest and second-largest cloud services in the EU, respectively, and referred to lock-in effects and high switching costs. The announcement described a preliminary position—not a final designation. The Commission also said that over half of EU businesses rely on cloud computing; that figure belongs to the context of the same dated announcement, not to an independent provider comparison.
Best Value
Estimate what it would take to move the workload: data export, application changes, service replacements, egress charges, parallel operation and validation. Check how the contract handles data return and deletion, and whether you can retrieve data in usable formats. A portability plan does not require choosing the cheapest or most portable provider at any cost; it makes the trade-off explicit before the workload is dependent on one platform.
Use a decision sequence and escalate unresolved risks
- Write the boundary: Define required locations separately for storage, processing, backups, support and administrative access.
- Shortlist exact services: Compare the services and configurations the workload will actually use, not just provider-wide claims.
- Request evidence: Gather data-flow and location documents, subprocessor details, access and maintenance terms, transfer information, assurance reports and contract provisions.
- Apply gates and scoring: Reject options that fail mandatory requirements; score the rest against documented evidence and workload priorities.
- Resolve open legal or security questions: Have privacy counsel, security teams or other qualified reviewers assess uncertain transfers, sector rules, access arrangements and assurance scope before approval.
- Record and revisit: Keep the decision, assumptions and service-specific evidence together, and recheck them when the service, contract, destination status or relevant certification changes.
The available information here does not establish a complete, current and comparable inventory of Azure, Google Cloud, OVHcloud, Scaleway and other providers. It therefore cannot support a universal “best European provider” ranking. The defensible choice is the service that meets your defined requirements with evidence you can verify and terms you can enforce.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
