Organisations use the Compliance Tool to record information on risks, controls, tasks, documents, audits and evidence. Customers understandably want to know where this data is held and which parties may have access.
De Compliance Afdeling chooses a European data supply chain. Our policy is that customer data is stored and processed within the European Union. New suppliers and changes in the chain are assessed in advance for privacy, security and continuity.
Data residency describes where data is stored. Data sovereignty also considers legislation, contracting entities, ownership structure, support access and the complete supplier chain.
What does European data storage mean?
European data storage means that primary customer data and the storage facilities used for it are located within the European Union. For a complete picture, you must also consider backups, logging, monitoring and temporary technical data.
For the Compliance Tool, this includes:
- information entered or uploaded by users;
- risks, controls, tasks and responsibilities;
- documents, audit information and evidence;
- backups and information needed for recovery;
- technical logging for security and availability.
Why a European data centre alone is not enough
A server location within Europe does not fully answer who can gain access and which laws govern a supplier. We therefore assess several layers of the service.
Where are application data, files and backups held?
From which countries can administrators and support staff gain access?
Which legal entity is the agreement with, and which law applies?
Which subprocessors provide underlying services?
How do we assess suppliers and subprocessors?
Suppliers are not selected solely on functionality and price. Data processing, security controls, continuity and underlying parties also form part of the assessment.
We consider factors including:
- the supplier's place of establishment and legal entity;
- the locations where data is stored and processed;
- the use of subprocessors and changes to them;
- access by support, administration and monitoring teams;
- arrangements for incident reporting, deletion and availability;
- audit opportunities and available assurance information.
The supplier chain is reassessed periodically. Changes at a supplier can also affect the processing of customer data.
How do we handle transfers outside the EEA?
Unnecessary transfers of customer data outside the European Economic Area are inconsistent with our policy. Any potential transfer or access from a third country must be identified and assessed in advance.
Contractual safeguards are not the only relevant factor. The nature of the data, technical security, access rights and the practical necessity of the processing also matter.
Where can you find verifiable, current information?
This knowledge base article explains our approach in plain language. Due diligence and supplier assessments require current, verifiable information. We therefore make the latest policy and supplier information available on request.
You can request information on data locations, suppliers, subprocessors and relevant security documentation, among other things.
Which questions can you ask software suppliers?
To assess European data storage properly, do not just ask where the server is located: check the entire chain.
- Where are primary data, backups and log files held?
- Which legal entity is your contracting party?
- Which suppliers and subprocessors are involved?
- From which countries is technical or human access possible?
- How are you informed of changes in the supplier chain?
- Which arrangements apply to incidents, termination and deletion?
- Which certificates, reports and contractual safeguards are available?
Conclusion
De Compliance Afdeling's policy is that customer data in the Compliance Tool is stored and processed within the European Union. A thorough assessment does not stop at the data centre's location, however.
We therefore also consider suppliers, subprocessors, jurisdiction, support access, administration locations and contractual arrangements. This knowledge base provides the public explanation; current, verifiable information is available on request.