Where Your AI Data May Live: an EU Data-Residency Checklist for Local and Hybrid Deployments
By the end of this post you will have a one-page map of where every piece of data your AI touches is processed and stored, a decision for each flow (local, EU-hosted, or cloud with safeguards), and the record that shows you made the decision. The cheapest place to run the local part is the PC you already own.
What you need
- A list of your AI uses: assistants, document processing, RAG over your files, the model inside a SaaS tool.
- Regulation (EU) 2016/679 (GDPR), Chapter V, Articles 44 to 49, on EUR-Lex.
- The Commission’s current list of adequacy decisions.
- Ninety minutes and a spreadsheet. A terminal for Step 5.
Two words that are not the same
| Term | Question it answers | Example |
|---|---|---|
| Data residency | Where is the data physically stored and processed? | ”In a data centre in Frankfurt” |
| Data sovereignty | Whose law can compel access to it? | The provider’s home jurisdiction can reach data held abroad by its subsidiaries |
GDPR does not require data to stay in the EU. It regulates transfers out of the European Economic Area (EEA). A European region of a non-EU provider solves residency, and leaves sovereignty to the contract and the provider’s home law. A model running on hardware in your building solves both, because there is no transfer and no third party.
Step 1: Map every flow (30 minutes)
One row per kind of data, per AI use. Most companies find six to eight rows.
| Flow | Example | Processed where | Stored where | Who can read it |
|---|---|---|---|---|
| Prompts and answers | Staff questions to an assistant | ? | Provider logs, 30 days? | ? |
| Documents sent for processing | Invoices, contracts, CVs | ? | ? | ? |
| Embeddings | Vectors of your manuals for RAG | ? | Vector database | ? |
| Application logs | Who asked what, when | ? | ? | ? |
| Model weights | The 7B model itself | Local disk | Local disk | You |
| Backups | Copies of all of the above | ? | ? | ? |
Question marks are the deliverable of Step 1. For a SaaS tool, the answers are in its data processing agreement and sub-processor list; if you cannot find them in ten minutes, that is an answer too.
Step 2: Classify each flow (15 minutes)
Add three columns and tick what applies.
- Personal data (GDPR)? Names, emails, CVs, customer histories. Embeddings of documents that contain personal data are still personal data.
- Special categories (Art. 9)? Health, union membership, biometrics, beliefs. These raise the bar for every later choice.
- Public-sector client? In Spain, systems that provide services to public bodies fall under the Esquema Nacional de Seguridad, Real Decreto 311/2022, with its three categories (básica, media, alta) and a conformity declaration or certificate that the contracting body must require (BOE). If you sell to a town hall or a hospital, the flow inherits that requirement.
Step 3: For any flow that leaves the EEA, name the mechanism (15 minutes)
| Mechanism | When it works | What you must keep |
|---|---|---|
| Adequacy decision (Art. 45) | The destination is on the Commission list: Andorra, Argentina, Brazil (mutual decision finalised February 2026), Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom (renewed December 2025), Uruguay, and the United States for organisations certified under the Data Privacy Framework | The provider’s certification or the country name in your record |
| Standard contractual clauses (Art. 46) | Any other destination | The signed clauses plus a transfer impact assessment |
| Derogations (Art. 49) | Occasional, specific situations such as explicit consent for one transfer | Not a basis for a daily workflow |
On the United States: the General Court dismissed the challenge to the Data Privacy Framework on 3 September 2025 in case T-553/23 (curia press release), and an appeal to the Court of Justice is pending. The framework is valid today. Keep signed standard clauses in the drawer for any US processor, so a future judgment changes a file, not your operations.
Step 4: Decide where each flow runs (15 minutes)
| Option | Residency | Sovereignty | What it costs you | Good for |
|---|---|---|---|---|
| Local, on hardware you own | Your building | Your jurisdiction | A EUR 250 board to a EUR 920 Mac mini, plus backups and access control you run | Personal data, special categories, public-sector work, anything you would not email |
| EU-headquartered provider, EU region | EU | EU | A contract, an Article 28 processor agreement, a sub-processor check | Overflow capacity, bigger models than your box runs |
| Non-EU provider, with Step 3 mechanism | Wherever the region is | The provider’s home law | Clauses, transfer impact assessment, and the fallback plan | The 5 percent of tasks that need a frontier model and contain no personal data |
The pattern we deploy is the middle path called hybrid: routine work with personal data stays on the local machine; anonymised or synthetic prompts may go to a metered cloud key. Our break-even post shows the local box also pays for itself once several people use it daily.
Step 5: Prove the local box does not phone home (10 minutes)
Auditors and clients like a demonstration more than a paragraph. On any Linux machine running Ollama:
# 1. Bind the server to the loopback interface only
export OLLAMA_HOST=127.0.0.1:11434
ollama serve &
# 2. Pull the model once (this is the only outbound connection you will ever see)
ollama pull qwen2.5-coder:7b
# 3. Run a prompt while watching connections
ss -tnp | grep -i ollama # before: nothing outbound
ollama run qwen2.5-coder:7b "Summarise: [paste a document]"
ss -tnp | grep -i ollama # during: only 127.0.0.1 <-> 127.0.0.1
# 4. Show what is resident
ollama psOn our workstation on 2026-09-09, ollama ps showed qwen2.5-coder:7b, 6.6 GB, 100% GPU, and the model answered a 291-token invoice prompt at 34.4 tokens per second. Step 3 of the script shows no connection outside the machine. Unplug the network cable and repeat if you want the theatrical version; it still works.
Step 6: Write it down (15 minutes)
- Add the map to your Article 30 record of processing activities; the “recipients” and “transfers” columns are exactly Steps 1 and 3.
- If any flow is high-risk for individuals (systematic monitoring, special categories at scale), the map is the first page of the Article 35 data protection impact assessment.
- Every provider in the EU-hosted or cloud rows needs an Article 28 processor agreement; file it next to the map.
- Local flows still need a backup location, an access list and a log retention period. Write them in the same page. Our privacy by design post has the defaults we use.
Honest limits
- Local removes the transfer question; it does not remove GDPR. Lawful basis, minimisation, retention and access control are still your job, on your hardware.
- Residency of the model matters less than people think: open-weight models are files, and the licence is what you check. What matters is where prompts, documents and logs go.
- A 7B model on a mini PC will not do everything a frontier model does. Plan the cloud row for those tasks, and strip personal data before they go.
Next steps
- Defaults for the local row: GDPR Article 25 and local AI.
- Cost of the local row: Cloud vs local, your break-even.
- Which of your uses are high-risk: EU AI Act compliance guide 2026 and our compliance page.
Work with us
We produce this map with clients in a single afternoon, then install the local row on hardware they keep. If you want the afternoon, get in touch or read how our consulting works.