Where Your Email Data Lives: EU Data Residency Explained

Every email campaign creates personal data. Your list holds names and email addresses. Your sending service keeps a copy of each message and records each delivery, bounce and complaint. Opens and clicks create more records. All this data sits on servers somewhere, and the companies that run those servers can usually access it.

Customers and partners in Europe often ask whether their data stays in the EU. The GDPR does not require this. It allows personal data to leave the EU, but only under certain conditions. Article 44 of the GDPR says that a transfer "shall take place only if" the conditions of its Chapter V are met. Data residency means keeping data in the EU. This is one way to reduce the number of transfers you need to justify.

This guide explains where email data goes, when moving it counts as a transfer, and how to keep it in the EU.

This guide covers:

1. Three different questions
2. Where your email data goes
3. When moving data counts as a transfer
4. The legal tools for a transfer
5. The EU-US Data Privacy Framework in October 2026
6. What a sending service's EU region covers
7. Residency is not immunity from foreign law
8. Keeping data in the EU with AcelleMail

It ends with the most common mistakes and a one-screen summary.

Not legal advice. This guide explains the EU rules in general terms and links to the official texts. It reflects texts published up to 25 October 2026. For a decision that matters, ask a lawyer or your data protection authority.

1. Three different questions#

"Is our data in the EU?" sounds like one question. It usually covers three different questions.

1. Where is the data stored and processed? This is data residency. A provider promises where it keeps your data, and you set this up in your settings and your contract. AWS, for example, tells its customers: "You choose the AWS Region(s) in which your content is stored."
2. Does moving the data count as a transfer? This is a legal question with a legal test, explained in section 3. If the answer is yes, the transfer needs one of the legal tools in section 4.
3. Which country's laws can reach the data? A provider must follow the laws of the country where it is based, and some of those laws reach data it keeps abroad. US law, for example, applies to data that a US provider controls "regardless of whether such communication, record, or other information is located within or outside of the United States", as 18 U.S.C. 2713 puts it.

The answers to these three questions can differ. Data that a US company stores in Frankfurt is in the EU, but US law can still reach it. Data stored in Switzerland is outside the EU, but the transfer is easy to justify. The European Commission has decided that Switzerland offers an adequate level of protection (section 4).

2. Where your email data goes#

Before you can say where your data is, you need to list every place it goes. The European Data Protection Board (EDPB) says this is the first step. Its Recommendations 01/2020 say: "you must know where the personal data you exported may be located or processed by the importers (map of destinations)."

For an email sender, the map usually includes these places:

• Your email platform. Its database holds your contacts, their fields and consent records, your campaigns and the events that come back. Uploaded files are stored on a disk or in cloud storage.
• Backups. A backup usually holds a full copy of your list. Another company often keeps it.
• Your sending service. It receives each message and keeps records about it, as Email Sending Explained shows. Mailgun, for example, keeps messages, event logs, suppressions, mailing lists, tags, statistics, routes and IP addresses in the region you choose.
• A verification service, if you check addresses before sending. It receives each address you check.
• Other tools that receive copies of your contacts, such as a CRM, a form builder or an analytics tool.
• People who log in from elsewhere. A developer or a support team that accesses your data from another country is also part of the map (section 3).

The recipients' own mailbox providers also receive each message. This is part of delivering email to the people you write to, and you do not choose where their mailboxes are.

3. When moving data counts as a transfer#

The GDPR does not define exactly what a transfer is. The EDPB notes that "The GDPR does not provide for a legal definition" of the term. In its Guidelines 05/2021, it sets out three conditions that must all be met:

1. A controller or a processor, the "exporter", is subject to the GDPR for this processing.
2. The exporter sends personal data to another controller or processor, the "importer", or makes it available to them.
3. "The importer is in a third country", which means a country outside the European Economic Area (EEA). The EEA is the EU plus Iceland, Liechtenstein and Norway, where the GDPR also applies.

Two details often catch email senders out. First, reading data from abroad counts. The EDPB says that "remote access from a third country" is a transfer when the three conditions are met. This applies even when someone only looks at the data on a screen, for example during support or troubleshooting. Storage in a cloud outside the EEA also counts.

Second, the chain can be longer than you think. Your sending service may use other processors, which may also handle your data. Article 28(2) says: "The processor shall not engage another processor without prior specific or general written authorisation of the controller."

Not every movement of data is a transfer. When data stays inside one company and is not shared with another controller or processor, the EDPB calls this "internal processing", and Chapter V does not apply. Its example is an employee who opens the company's data on a business trip abroad. A company in the same group still counts as another company: when an EU subsidiary shares data with its parent company abroad, the EDPB treats this as a transfer. Even for internal processing, the EDPB warns of risks such as "conflicting national laws or disproportionate government access in the third country."

4. The legal tools for a transfer#

When a transfer takes place, it needs one of the legal tools in Chapter V of the GDPR. Three of these tools matter to most email senders.

An adequacy decision. Under Article 45(1), a transfer may take place when the Commission has decided that the destination "ensures an adequate level of protection". Such a transfer needs no specific authorisation, although the rest of the GDPR still applies. As of October 2026, the Commission's list includes these places:

• In Europe: Andorra, the Faroe Islands, Guernsey, the Isle of Man, Jersey, Switzerland and the United Kingdom. The decision for the United Kingdom was renewed in December 2025.
• Elsewhere: Argentina, Brazil, Canada (for businesses), Israel, Japan, New Zealand, South Korea, the United States (for companies in the EU-US Data Privacy Framework) and Uruguay.
• The European Patent Organisation.

Standard contractual clauses (SCCs). Under Article 46(1), data can go to a place without an adequacy decision "only if the controller or processor has provided appropriate safeguards". The people concerned must also have enforceable rights and legal remedies. The usual safeguard is a set of standard contractual clauses from the Commission. The current version dates from 4 June 2021. Providers usually include these clauses in their data processing agreement (DPA).

The clauses are not a formality. In its Schrems II judgment of 16 July 2020, the Court of Justice said that data sent under them needs protection "essentially equivalent to that guaranteed within the European Union". So the exporter has to check the laws of the destination country. Extra measures, such as encryption, may be needed. The EDPB's recommendations explain the steps to take, starting with "Know your transfers".

A derogation. Article 49 lists a few exceptions. One applies when the person "has explicitly consented to the proposed transfer, after having been informed of the possible risks". Its title, "Derogations for specific situations", shows that these exceptions are meant for particular cases. They are not suitable for regularly sending a whole list.

Tool	When it applies	What you check
Adequacy decision	The destination is on the Commission's list	That the recipient is covered, for example that a US company is on the Data Privacy Framework List
Standard contractual clauses	No adequacy decision covers the recipient	That the clauses are in the provider's DPA, and what the destination's law allows
Derogation (Article 49)	A specific situation, such as explicit consent	That the case fits one of the listed situations

5. The EU-US Data Privacy Framework in October 2026#

Many sending services, verification services and cloud providers are American. That is why many email senders rely on the EU-US Data Privacy Framework (DPF). It is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. The decision covers data sent to US organisations "that are included in the ‘Data Privacy Framework List’".

That condition matters. The EDPB points out that transfers to US companies that are not on the list "cannot be based on the Adequacy Decision". You can search the Data Privacy Framework list for a company. For companies that are not on it, you need standard contractual clauses or another tool from section 4. The EDPB adds that the US safeguards for national security, including a redress mechanism, "apply to all data transferred to the US, regardless of the transfer tool used". So when you assess such a transfer, you should take the Commission's assessment of US law into account.

The DPF is the third adequacy decision for transfers to the United States. The Court of Justice declared the first two invalid:

• Safe Harbour, adopted on 26 July 2000, was declared invalid on 6 October 2015.
• Privacy Shield, adopted on 12 July 2016, was declared invalid on 16 July 2020.

The DPF has also been challenged:

• On 3 September 2025, the General Court dismissed an action against it brought by Philippe Latombe (Case T-553/23).
• On 31 October 2025, he appealed to the Court of Justice (Case C-703/25 P). The appeal is still pending.
• On 29 June 2026, the US Supreme Court decided Trump v. Slaughter, a case about the independence of the Federal Trade Commission. In a letter of 31 July 2026, the EDPB "asks the European Commission to closely assess whether this development affects the functioning" of the DPF decision.

As of October 2026, the decision remains in force, and transfers to listed companies can rely on it. Its two predecessors were declared invalid, so check whether your provider's DPA also includes standard contractual clauses. If the framework were struck down, these clauses could be a fallback, together with the checks described in section 4.

6. What a sending service's EU region covers#

Several sending services let you choose the EU region. Their offers differ in what stays in the region and in the setup it needs.

Amazon SES works per AWS Region, so you choose a region when you set it up. The AWS endpoint list has seven regions in Europe: Frankfurt, Zurich, Stockholm, Milan, Ireland, London and Paris. London is in the United Kingdom and Zurich is in Switzerland. Both are outside the EU, although both have adequacy decisions. The AWS Data Privacy FAQ says: "We will not move or replicate your content outside of your chosen AWS Region(s) without your agreement."

Mailgun has an EU region with its own endpoints: api.eu.mailgun.net for the API and smtp.eu.mailgun.org for SMTP. Mailgun's API overview says that "message data never leaves the region in which it is processed". Account data is handled differently: account information, user accounts, billing details, API keys and domain names are copied across regions.

SendGrid offers EU data residency with three conditions: an EU subuser, a dedicated EU IP address and the EU endpoint. SendGrid's data residency FAQ says that residency "requires a dedicated EU IP". It calls the EU endpoint, api.eu.sendgrid.com, "critical to data residency". For sending over SMTP, SendGrid's guide to EU sending gives the EU host smtp.eu.sendgrid.net. The FAQ also warns that sending through a parent account or a global subuser "routes data outside the EU". Some processing can still happen outside the EU: for support requests that you make, for engineering work, and when you use the Point Delete Service or the Whitelist mail settings. SendGrid's page on EU Data Processing Locations adds: "If you configure accounts improperly, Twilio might store your data, process your data, or both outside of the EU."

Service	How you choose the EU	What stays in the region	What can still leave
Amazon SES	Choose an EU region for the account	Your content, unless you agree otherwise	Data AWS must disclose under a valid order (section 7)
Mailgun	Create the domain in the EU region and use the EU endpoints	Messages, event logs, suppressions, mailing lists, tags, statistics, routes, IP addresses	Account information, user accounts, billing details, API keys, domain names
SendGrid	EU subuser, dedicated EU IP and the EU endpoint	Recipient addresses and event data	Data needed for support, engineering work and some features

Read each provider's list of exceptions before telling a customer that their data stays in the EU.

7. Residency is not immunity from foreign law#

An EU region decides where the data is stored. It does not decide which governments can ask for it. A US provider must respond to US orders for data it controls, wherever that data is stored, as the law quoted in section 1 says.

AWS describes the same limit. It will not disclose customer content "unless we're required to do so to comply with the law or a valid and binding order of a government body". If it has to disclose content, AWS says it will give "reasonable notice" unless the law forbids it. For a sensitive list, ask each provider which laws it must follow.

Encryption helps in some cases. The EDPB's first example is a backup kept with a hosting provider abroad. Strong encryption before the data leaves can protect it, if several conditions are met. One of them is that "the keys are retained solely under the control of the data exporter". A backup that you encrypt on your server, using keys that only you hold, does not reveal its contents to the company that stores it.

8. Keeping data in the EU with AcelleMail#

When you run AcelleMail yourself, the platform's own data stays on the server you choose. Contacts, campaigns and tracking events are written to its database. The application itself records opens and clicks because the tracking links lead to your own installation. Email Tracking and Privacy Explained shows how that tracking works. If your server is in an EU data centre, the database and the files on that server stay in the EU. The other places on the map still need checking. Server Requirements and Hosting Options compares hosting providers.

Where AcelleMail keeps uploaded files#

Administrators choose where uploaded files are stored, under Settings → Storage Engine.

1. The page explains what this setting controls: "Customer media and campaign attachments are written to the engine selected here."
2. Local disk keeps the files on your own server: "Files are written to the application server disk, under storage/app." If a storage plugin adds another engine, check where that storage is located.

Choose an EU region for your sending service#

Open Sending → Sending servers, click Add server and choose the connection.

1. For Amazon Web Service API, choose the region in AWS region. The EU regions in the list are Europe (Frankfurt), EU (Ireland), Europe (Paris), Europe (Milan) and Europe (Stockholm). Europe (London) is in the United Kingdom. Amazon Web Service SMTP has the same field, and AcelleMail selects the SMTP host based on the region.

1. For Mailgun API or Mailgun SMTP, choose EU Server in Mailgun region. Your domain must also be set up in Mailgun's EU region.
2. For Mailgun SMTP, also change SMTP host to smtp.eu.mailgun.org. The field starts with smtp.mailgun.org, Mailgun's US host, and choosing the region does not change it.

The SendGrid API connection asks only for an API key, and it always uses SendGrid's global endpoint. So it cannot use SendGrid's EU data residency.

The SendGrid SMTP connection sends through the host in its SMTP host field, so it can use SendGrid's EU host, smtp.eu.sendgrid.net. Its connection test and domain checks still go to the global endpoint, so check with SendGrid that this setup meets its conditions.

For SparkPost API, choose SparkPost EU in SparkPost endpoint.

The rest of the map#

• Verification services. Under Sending → Email verification, AcelleMail connects to services such as Clearout, ZeroBounce and Kickbox. Each service receives the addresses you check, so find out where it processes them. How to Verify Your Email List Before You Send explains how to set this up.
• AI features. If you use the AI assistant, its requests go to the AI engine that your administrator connected. They can include contact details, because the assistant can look up subscribers. The Acelle Hub, OpenAI and Anthropic are other companies' services, and the Hub passes requests on to AI engines such as Claude or GPT models. Ollama runs on a server that you choose.
• Backups. Keep them in the EU, or encrypt them on your server before they leave. Automated Database Backups and Data Encryption for Self-Hosted AcelleMail explain how.
• Your contracts. Sign the DPA of each provider on the map, and record which legal tool covers each transfer. GDPR for Email Marketing Explained explains the rules for processors in general.

9. Common mistakes#

What you see	Why it is a problem	What to do
"Our server is in Frankfurt, so all our data stays in the EU."	The sending service, the verification service, backups and support access can all be elsewhere.	Map each place the data goes, as in section 2.
You tell customers that the GDPR requires EU storage.	It does not. It sets conditions for transfers.	Say where the data is stored, and which legal tool covers each transfer.
You chose an EU option, but data still leaves the EU.	Some offers need a specific setup, and a global account or endpoint sends data elsewhere.	Follow the provider's documented setup, and read its list of exceptions.
You picked Europe (London) to keep data in the EU.	London is in the United Kingdom, which is outside the EU.	Choose an EU region if your contracts say "EU".
A US provider is not on the Data Privacy Framework List.	The framework covers only organisations on the list.	Use standard contractual clauses, or choose another provider.
You rely on the framework alone.	Its two predecessors were struck down, and an appeal is pending.	Check that the provider's DPA also includes standard contractual clauses.
A support team in another country can open your account.	If that team works for another company, the EDPB counts this remote access as a transfer.	Include support access in your map, and check which company gives the support.
Backups go to another country unencrypted.	A backup usually holds a full copy of your list.	Encrypt backups on your server, with keys that only you hold.

Summary#

1. "Is our data in the EU?" covers three questions: where the data is stored, whether moving it is a transfer, and whose laws can reach it.
2. The GDPR does not require EU storage. It allows transfers under the conditions of Chapter V.
3. Map each place your email data goes: the platform, backups, the sending service, the verification service, other tools and remote access.
4. A transfer happens when a controller or processor subject to the GDPR sends data to another company in a third country, or lets that company access it. Remote access counts too.
5. A transfer needs a legal tool, usually an adequacy decision or standard contractual clauses. Derogations are for specific situations.
6. As of October 2026, the EU-US Data Privacy Framework is in force for listed companies. An appeal is pending, and the EDPB has asked for a review.
7. An EU region keeps data in the EU only with the right setup, and each provider lists exceptions.
8. Storage in the EU does not stop foreign laws from reaching a provider. Encryption with your own keys can help.
9. In AcelleMail, host the platform in an EU data centre, keep files on the local disk or in EU storage, and choose an EU region for the sending service.

Terms used here are defined in the Email Marketing Glossary.

♡ Sign in to like 0 💬 0 comments