EU data residency

The GDPR does not ban transfers, but it demands a valid basis and an assessment. In practice the demand for EU location comes more often from customers, public tenders and sector rules than from the law itself. And because earlier arrangements have been struck down by the EU Court of Justice, many organisations prefer removing the risk to documenting it year after year.

For many businesses it covers most of the need, as customer data is stored and processed in the EU. Microsoft remains a US company, though, and some support and security data falls under exceptions. We therefore still carry out a transfer assessment and review your settings, so you know exactly what is held where.

For a company with email, a website and one line-of-business system, usually four to eight weeks including the rehearsal. The time goes on clarifying integrations and agreeing a cut-over window rather than on copying data. If you run many systems exchanging data, they set the timetable.

No. The copy is built and synchronised in advance, and the switch is scheduled for an evening or weekend. Downtime is normally counted in hours, and we state it before the work begins rather than afterwards. The entire project is carried out remotely.

There are several routes: run an open source alternative on your own EU server, split the data so personal information stays in Europe, or keep the tool with a documented transfer basis. Moving every last service is rarely needed. Usually it is enough to deal with the processing that involves personal data.