# Where Your Email Data Lives: EU Data Residency Explained > Where an email platform keeps contact and event data, when sending it abroad is a transfer, the EU-US framework in 2026, and how to keep data in the EU. - Canonical URL: https://acellesend.com/kb/articles/email-data-residency-explained - Author: Daniel Reyes, Technical Editor - Category: Domain Knowledge — Email marketing fundamentals — consent, deliverability, metrics, list quality, key terms - Content type: guide · Difficulty: beginner - Tags: Email Marketing Basics, GDPR, Data Protection, Privacy, Self Hosted, Amazon SES - Published: 2026-10-25 · Last updated: 2026-10-26 - Reading time: 21 min - Publisher: AcelleMail Knowledge Base, https://acellesend.com/kb --- Every email campaign creates personal data. Your list holds names and email addresses. Your sending service keeps a copy of each message and records each delivery, bounce and complaint. Opens and clicks create more records. All this data sits on servers somewhere, and the companies that run those servers can usually access it. Customers and partners in Europe often ask whether their data stays in the EU. The GDPR does not require this. It allows personal data to leave the EU, but only under certain conditions. [Article 44 of the GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) says that a transfer "shall take place only if" the conditions of its Chapter V are met. Data residency means keeping data in the EU. This is one way to reduce the number of transfers you need to justify. This guide explains where email data goes, when moving it counts as a transfer, and how to keep it in the EU. This guide covers: 1. Three different questions 2. Where your email data goes 3. When moving data counts as a transfer 4. The legal tools for a transfer 5. The EU-US Data Privacy Framework in October 2026 6. What a sending service's EU region covers 7. Residency is not immunity from foreign law 8. Keeping data in the EU with AcelleMail It ends with the most common mistakes and a one-screen summary. > **Not legal advice.** This guide explains the EU rules in general terms and links to the official texts. It > reflects texts published up to 25 October 2026. For a decision that matters, ask a lawyer or your data > protection authority. ## 1. Three different questions "Is our data in the EU?" sounds like one question. It usually covers three different questions. 1. **Where is the data stored and processed?** This is data residency. A provider promises where it keeps your data, and you set this up in your settings and your contract. AWS, for example, tells its customers: "You choose the AWS Region(s) in which your content is stored." 2. **Does moving the data count as a transfer?** This is a legal question with a legal test, explained in section 3. If the answer is yes, the transfer needs one of the legal tools in section 4. 3. **Which country's laws can reach the data?** A provider must follow the laws of the country where it is based, and some of those laws reach data it keeps abroad. US law, for example, applies to data that a US provider controls "regardless of whether such communication, record, or other information is located within or outside of the United States", as [18 U.S.C. 2713](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap121-sec2713.htm) puts it. The answers to these three questions can differ. Data that a US company stores in Frankfurt is in the EU, but US law can still reach it. Data stored in Switzerland is outside the EU, but the transfer is easy to justify. The European Commission has decided that Switzerland offers an adequate level of protection (section 4). ![Three questions behind the question of whether data is in the EU. 1 Where is it stored? This is data residency: you choose it through the provider's region and your contract, for example an Amazon SES account in Europe (Frankfurt). 2 Is it a transfer? This is the GDPR's test: a transfer outside the EEA needs a legal tool, such as an adequacy decision or standard contractual clauses, for example when a support team in the US opens your account. 3 Whose law can reach it? A provider follows the laws of its home country, and some of those laws reach data it stores abroad: US law can reach data that a US provider keeps in Frankfurt. Two cases: data that a US company keeps in Frankfurt is in the EU but within reach of US law, and data kept in Switzerland, which has an adequacy decision, is outside the EU but easy to justify.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/01-three-questions.png) ## 2. Where your email data goes Before you can say where your data is, you need to list every place it goes. The European Data Protection Board (EDPB) says this is the first step. Its [Recommendations 01/2020](https://www.edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf) say: "you must know where the personal data you exported may be located or processed by the importers (map of destinations)." For an email sender, the map usually includes these places: - **Your email platform.** Its database holds your contacts, their fields and consent records, your campaigns and the events that come back. Uploaded files are stored on a disk or in cloud storage. - **Backups.** A backup usually holds a full copy of your list. Another company often keeps it. - **Your sending service.** It receives each message and keeps records about it, as [Email Sending Explained](https://acellesend.com/kb/articles/email-sending-explained) shows. Mailgun, for example, keeps messages, event logs, suppressions, mailing lists, tags, statistics, routes and IP addresses in the region you choose. - **A verification service**, if you check addresses before sending. It receives each address you check. - **Other tools** that receive copies of your contacts, such as a CRM, a form builder or an analytics tool. - **People who log in from elsewhere.** A developer or a support team that accesses your data from another country is also part of the map (section 3). The recipients' own mailbox providers also receive each message. This is part of delivering email to the people you write to, and you do not choose where their mailboxes are. ![A map of where email data goes. Your email platform is in the centre: its server and database hold the core of your email data, with contacts, campaigns, events and files. Above it are your sending service, a verification service and backups. Below it are other tools such as a CRM, remote access by developers or support teams from another country, and the recipients' mailboxes, which are not your choice. The EDPB calls this a map of destinations, and you need to know them before assessing any transfer.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/02-where-email-data-goes.png) ## 3. When moving data counts as a transfer The GDPR does not define exactly what a transfer is. The EDPB notes that "The GDPR does not provide for a legal definition" of the term. In its [Guidelines 05/2021](https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf), it sets out three conditions that must all be met: 1. A controller or a processor, the "exporter", is subject to the GDPR for this processing. 2. The exporter sends personal data to another controller or processor, the "importer", or makes it available to them. 3. "The importer is in a third country", which means a country outside the European Economic Area (EEA). The EEA is the EU plus Iceland, Liechtenstein and Norway, where the GDPR also applies. Two details often catch email senders out. First, reading data from abroad counts. The EDPB says that "remote access from a third country" is a transfer when the three conditions are met. This applies even when someone only looks at the data on a screen, for example during support or troubleshooting. Storage in a cloud outside the EEA also counts. Second, the chain can be longer than you think. Your sending service may use other processors, which may also handle your data. [Article 28(2)](https://eur-lex.europa.eu/eli/reg/2016/679/oj) says: "The processor shall not engage another processor without prior specific or general written authorisation of the controller." Not every movement of data is a transfer. When data stays inside one company and is not shared with another controller or processor, the EDPB calls this "internal processing", and Chapter V does not apply. Its example is an employee who opens the company's data on a business trip abroad. A company in the same group still counts as another company: when an EU subsidiary shares data with its parent company abroad, the EDPB treats this as a transfer. Even for internal processing, the EDPB warns of risks such as "conflicting national laws or disproportionate government access in the third country." ![The EDPB sets out three conditions for a transfer: 1 the sender is subject to the GDPR, 2 another company receives the data or can access it, and 3 that company is outside the EEA. When all three are met, it is a transfer, and it needs a legal tool under Chapter V, such as an adequacy decision or standard contractual clauses. Remote access by a company abroad, even only on a screen, and cloud storage abroad count. Internal processing within one company is not a transfer, but its risks still need to be considered.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/03-is-it-a-transfer.png) ## 4. The legal tools for a transfer When a transfer takes place, it needs one of the legal tools in Chapter V of the GDPR. Three of these tools matter to most email senders. **An adequacy decision.** Under Article 45(1), a transfer may take place when the Commission has decided that the destination "ensures an adequate level of protection". Such a transfer needs no specific authorisation, although the rest of the GDPR still applies. As of October 2026, [the Commission's list](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) includes these places: - In Europe: Andorra, the Faroe Islands, Guernsey, the Isle of Man, Jersey, Switzerland and the United Kingdom. The decision for the United Kingdom was renewed in December 2025. - Elsewhere: Argentina, Brazil, Canada (for businesses), Israel, Japan, New Zealand, South Korea, the United States (for companies in the EU-US Data Privacy Framework) and Uruguay. - The European Patent Organisation. **Standard contractual clauses (SCCs).** Under Article 46(1), data can go to a place without an adequacy decision "only if the controller or processor has provided appropriate safeguards". The people concerned must also have enforceable rights and legal remedies. The usual safeguard is a set of [standard contractual clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) from the Commission. The current version dates from 4 June 2021. Providers usually include these clauses in their data processing agreement (DPA). The clauses are not a formality. In its Schrems II judgment of 16 July 2020, the Court of Justice said that data sent under them needs protection "essentially equivalent to that guaranteed within the European Union". So the exporter has to check the laws of the destination country. Extra measures, such as encryption, may be needed. The EDPB's recommendations explain the steps to take, starting with "Know your transfers". **A derogation.** Article 49 lists a few exceptions. One applies when the person "has explicitly consented to the proposed transfer, after having been informed of the possible risks". Its title, "Derogations for specific situations", shows that these exceptions are meant for particular cases. They are not suitable for regularly sending a whole list. | Tool | When it applies | What you check | |---|---|---| | Adequacy decision | The destination is on the Commission's list | That the recipient is covered, for example that a US company is on the Data Privacy Framework List | | Standard contractual clauses | No adequacy decision covers the recipient | That the clauses are in the provider's DPA, and what the destination's law allows | | Derogation (Article 49) | A specific situation, such as explicit consent | That the case fits one of the listed situations | ## 5. The EU-US Data Privacy Framework in October 2026 Many sending services, verification services and cloud providers are American. That is why many email senders rely on the EU-US Data Privacy Framework (DPF). It is based on [Commission Implementing Decision (EU) 2023/1795](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj) of 10 July 2023. The decision covers data sent to US organisations "that are included in the ‘Data Privacy Framework List’". That condition matters. The EDPB points out that transfers to US companies that are not on the list "cannot be based on the Adequacy Decision". You can search the [Data Privacy Framework list](https://www.dataprivacyframework.gov/list) for a company. For companies that are not on it, you need standard contractual clauses or another tool from section 4. The EDPB adds that the US safeguards for national security, including a redress mechanism, "apply to all data transferred to the US, regardless of the transfer tool used". So when you assess such a transfer, you should take the Commission's assessment of US law into account. The DPF is the third adequacy decision for transfers to the United States. The Court of Justice declared the first two invalid: - Safe Harbour, adopted on 26 July 2000, was declared invalid on 6 October 2015. - Privacy Shield, adopted on 12 July 2016, was declared invalid on 16 July 2020. The DPF has also been challenged: - On 3 September 2025, the General Court dismissed an action against it brought by Philippe Latombe (Case T-553/23). - On 31 October 2025, he appealed to the Court of Justice (Case C-703/25 P). The appeal is still pending. - On 29 June 2026, the US Supreme Court decided Trump v. Slaughter, a case about the independence of the Federal Trade Commission. In a [letter of 31 July 2026](https://www.edpb.europa.eu/system/files/2026-08/edpb_letter_20260731_us_supremecourt_judgment_trump_v_slaughter_en.pdf), the EDPB "asks the European Commission to closely assess whether this development affects the functioning" of the DPF decision. As of October 2026, the decision remains in force, and transfers to listed companies can rely on it. Its two predecessors were declared invalid, so check whether your provider's DPA also includes standard contractual clauses. If the framework were struck down, these clauses could be a fallback, together with the checks described in section 4. ![Three frameworks for EU-US transfers. Safe Harbour, adopted on 26 July 2000, was declared invalid on 6 October 2015. Privacy Shield, adopted on 12 July 2016, was declared invalid on 16 July 2020 in Schrems II. The Data Privacy Framework rests on Decision 2023/1795 of 10 July 2023. The General Court dismissed a challenge on 3 September 2025, an appeal was filed with the Court of Justice on 31 October 2025, and on 31 July 2026 the EDPB asked the Commission to assess a US ruling. In October 2026 it is in force for companies on the Data Privacy Framework List, and transfers to other US companies need another legal tool, such as standard contractual clauses.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/04-eu-us-transfers-timeline.png) ## 6. What a sending service's EU region covers Several sending services let you choose the EU region. Their offers differ in what stays in the region and in the setup it needs. **Amazon SES** works per AWS Region, so you choose a region when you set it up. The [AWS endpoint list](https://docs.aws.amazon.com/general/latest/gr/ses.html) has seven regions in Europe: Frankfurt, Zurich, Stockholm, Milan, Ireland, London and Paris. London is in the United Kingdom and Zurich is in Switzerland. Both are outside the EU, although both have adequacy decisions. The [AWS Data Privacy FAQ](https://aws.amazon.com/compliance/data-privacy-faq/) says: "We will not move or replicate your content outside of your chosen AWS Region(s) without your agreement." **Mailgun** has an EU region with its own endpoints: api.eu.mailgun.net for the API and smtp.eu.mailgun.org for SMTP. [Mailgun's API overview](https://documentation.mailgun.com/docs/mailgun/api-reference/api-overview) says that "message data never leaves the region in which it is processed". Account data is handled differently: account information, user accounts, billing details, API keys and domain names are copied across regions. **SendGrid** offers EU data residency with three conditions: an EU subuser, a dedicated EU IP address and the EU endpoint. [SendGrid's data residency FAQ](https://www.twilio.com/docs/sendgrid/data-residency/faq) says that residency "requires a dedicated EU IP". It calls the EU endpoint, api.eu.sendgrid.com, "critical to data residency". For sending over SMTP, [SendGrid's guide to EU sending](https://support.sendgrid.com/hc/en-us/articles/35912462688795-How-To-Add-EU-IP-s-to-Twilio-SendGrid-Accounts) gives the EU host smtp.eu.sendgrid.net. The FAQ also warns that sending through a parent account or a global subuser "routes data outside the EU". Some processing can still happen outside the EU: for support requests that you make, for engineering work, and when you use the Point Delete Service or the Whitelist mail settings. SendGrid's page on [EU Data Processing Locations](https://www.twilio.com/docs/sendgrid/data-residency/locations-eu) adds: "If you configure accounts improperly, Twilio might store your data, process your data, or both outside of the EU." | Service | How you choose the EU | What stays in the region | What can still leave | |---|---|---|---| | Amazon SES | Choose an EU region for the account | Your content, unless you agree otherwise | Data AWS must disclose under a valid order (section 7) | | Mailgun | Create the domain in the EU region and use the EU endpoints | Messages, event logs, suppressions, mailing lists, tags, statistics, routes, IP addresses | Account information, user accounts, billing details, API keys, domain names | | SendGrid | EU subuser, dedicated EU IP and the EU endpoint | Recipient addresses and event data | Data needed for support, engineering work and some features | Read each provider's list of exceptions before telling a customer that their data stays in the EU. ## 7. Residency is not immunity from foreign law An EU region decides where the data is stored. It does not decide which governments can ask for it. A US provider must respond to US orders for data it controls, wherever that data is stored, as the law quoted in section 1 says. AWS describes the same limit. It will not disclose customer content "unless we're required to do so to comply with the law or a valid and binding order of a government body". If it has to disclose content, AWS says it will give "reasonable notice" unless the law forbids it. For a sensitive list, ask each provider which laws it must follow. Encryption helps in some cases. The EDPB's first example is a backup kept with a hosting provider abroad. Strong encryption before the data leaves can protect it, if several conditions are met. One of them is that "the keys are retained solely under the control of the data exporter". A backup that you encrypt on your server, using keys that only you hold, does not reveal its contents to the company that stores it. ## 8. Keeping data in the EU with AcelleMail When you run AcelleMail yourself, the platform's own data stays on the server you choose. Contacts, campaigns and tracking events are written to its database. The application itself records opens and clicks because the tracking links lead to your own installation. [Email Tracking and Privacy Explained](https://acellesend.com/kb/articles/email-tracking-and-privacy-explained) shows how that tracking works. If your server is in an EU data centre, the database and the files on that server stay in the EU. The other places on the map still need checking. [Server Requirements and Hosting Options](https://acellesend.com/kb/articles/server-requirements-and-hosting-options) compares hosting providers. ### Where AcelleMail keeps uploaded files Administrators choose where uploaded files are stored, under **Settings** → **Storage Engine**. ![The Storage Engine settings page for administrators in AcelleMail, with two marks: 1 the page's explanation that customer media and campaign attachments are written to the engine selected here, and 2 the Local disk engine, which writes files to the application server disk under storage/app.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/05-storage-engine.png) 1. The page explains what this setting controls: "Customer media and campaign attachments are written to the engine selected here." 2. **Local disk** keeps the files on your own server: "Files are written to the application server disk, under storage/app." If a storage plugin adds another engine, check where that storage is located. ### Choose an EU region for your sending service Open **Sending** → **Sending servers**, click **Add server** and choose the connection. ![The Amazon Web Service API connection form in AcelleMail, with Europe (Frankfurt) chosen in the AWS region field, marked 1.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/06-amazon-ses-region.png) 1. For **Amazon Web Service API**, choose the region in **AWS region**. The EU regions in the list are **Europe (Frankfurt)**, **EU (Ireland)**, **Europe (Paris)**, **Europe (Milan)** and **Europe (Stockholm)**. **Europe (London)** is in the United Kingdom. **Amazon Web Service SMTP** has the same field, and AcelleMail selects the SMTP host based on the region. ![The Mailgun SMTP connection form in AcelleMail, with two marks: 1 EU Server chosen in Mailgun region, and 2 smtp.eu.mailgun.org typed in SMTP host.](https://acellesend.com/plugins/acelle/landing/images/help/kb/email-data-residency-explained/07-mailgun-region.png) 1. For **Mailgun API** or **Mailgun SMTP**, choose **EU Server** in **Mailgun region**. Your domain must also be set up in Mailgun's EU region. 2. For **Mailgun SMTP**, also change **SMTP host** to smtp.eu.mailgun.org. The field starts with smtp.mailgun.org, Mailgun's US host, and choosing the region does not change it. The **SendGrid API** connection asks only for an **API key**, and it always uses SendGrid's global endpoint. So it cannot use SendGrid's EU data residency. The **SendGrid SMTP** connection sends through the host in its **SMTP host** field, so it can use SendGrid's EU host, smtp.eu.sendgrid.net. Its connection test and domain checks still go to the global endpoint, so check with SendGrid that this setup meets its conditions. For **SparkPost API**, choose **SparkPost EU** in **SparkPost endpoint**. ### The rest of the map - **Verification services.** Under **Sending** → **Email verification**, AcelleMail connects to services such as Clearout, ZeroBounce and Kickbox. Each service receives the addresses you check, so find out where it processes them. [How to Verify Your Email List Before You Send](https://acellesend.com/kb/articles/how-to-verify-your-email-list-before-you-send) explains how to set this up. - **AI features.** If you use the AI assistant, its requests go to the AI engine that your administrator connected. They can include contact details, because the assistant can look up subscribers. The Acelle Hub, OpenAI and Anthropic are other companies' services, and the Hub passes requests on to AI engines such as Claude or GPT models. Ollama runs on a server that you choose. - **Backups.** Keep them in the EU, or encrypt them on your server before they leave. [Automated Database Backups](https://acellesend.com/kb/articles/automated-database-backups) and [Data Encryption for Self-Hosted AcelleMail](https://acellesend.com/kb/articles/data-encryption-for-self-hosted-platforms) explain how. - **Your contracts.** Sign the DPA of each provider on the map, and record which legal tool covers each transfer. [GDPR for Email Marketing Explained](https://acellesend.com/kb/articles/gdpr-for-email-marketing-explained) explains the rules for processors in general. ## 9. Common mistakes | What you see | Why it is a problem | What to do | |---|---|---| | "Our server is in Frankfurt, so all our data stays in the EU." | The sending service, the verification service, backups and support access can all be elsewhere. | Map each place the data goes, as in section 2. | | You tell customers that the GDPR requires EU storage. | It does not. It sets conditions for transfers. | Say where the data is stored, and which legal tool covers each transfer. | | You chose an EU option, but data still leaves the EU. | Some offers need a specific setup, and a global account or endpoint sends data elsewhere. | Follow the provider's documented setup, and read its list of exceptions. | | You picked **Europe (London)** to keep data in the EU. | London is in the United Kingdom, which is outside the EU. | Choose an EU region if your contracts say "EU". | | A US provider is not on the Data Privacy Framework List. | The framework covers only organisations on the list. | Use standard contractual clauses, or choose another provider. | | You rely on the framework alone. | Its two predecessors were struck down, and an appeal is pending. | Check that the provider's DPA also includes standard contractual clauses. | | A support team in another country can open your account. | If that team works for another company, the EDPB counts this remote access as a transfer. | Include support access in your map, and check which company gives the support. | | Backups go to another country unencrypted. | A backup usually holds a full copy of your list. | Encrypt backups on your server, with keys that only you hold. | ## Summary 1. "Is our data in the EU?" covers three questions: where the data is stored, whether moving it is a transfer, and whose laws can reach it. 2. The GDPR does not require EU storage. It allows transfers under the conditions of Chapter V. 3. Map each place your email data goes: the platform, backups, the sending service, the verification service, other tools and remote access. 4. A transfer happens when a controller or processor subject to the GDPR sends data to another company in a third country, or lets that company access it. Remote access counts too. 5. A transfer needs a legal tool, usually an adequacy decision or standard contractual clauses. Derogations are for specific situations. 6. As of October 2026, the EU-US Data Privacy Framework is in force for listed companies. An appeal is pending, and the EDPB has asked for a review. 7. An EU region keeps data in the EU only with the right setup, and each provider lists exceptions. 8. Storage in the EU does not stop foreign laws from reaching a provider. Encryption with your own keys can help. 9. In AcelleMail, host the platform in an EU data centre, keep files on the local disk or in EU storage, and choose an EU region for the sending service. Terms used here are defined in the [Email Marketing Glossary](https://acellesend.com/kb/articles/email-marketing-glossary). --- ## Related articles - [GDPR for Email Marketing Explained: What the Law Asks of Senders](https://acellesend.com/kb/articles/gdpr-for-email-marketing-explained): What the GDPR and the ePrivacy rules ask of anyone emailing people in the EU: lawful basis, privacy notice, rights, tracking, processors and deadlines. - [Email Sending Explained: SMTP, APIs and Sending Services](https://acellesend.com/kb/articles/email-sending-explained): What happens after you click Send: SMTP, reply codes, retries and bounces, SMTP or API, the three ways to send, and the AcelleMail settings. - [Email Tracking and Privacy Explained: Opens, Clicks and Consent](https://acellesend.com/kb/articles/email-tracking-and-privacy-explained): How open and click tracking work, why the numbers are not exact, what the 2026 CNIL, Garante and ICO guidance asks, and what to set in AcelleMail. - [Server Requirements and Hosting Options for AcelleMail](https://acellesend.com/kb/articles/server-requirements-and-hosting-options): The right server for AcelleMail is dictated by send volume, not subscriber count. A list of 5M subscribers mailed monthly needs less compute than a list of 100k mailed daily. This article gives concrete specs at four volume tiers, a current 2026 provider comparison, and the operational considerations that determine your real cost. - [How to Set Up Amazon SES with AcelleMail](https://acellesend.com/kb/articles/configuring-amazon-ses-with-acellemail): Create an IAM user and access key in AWS, connect Amazon SES to AcelleMail, share your verified domains with users, and let them verify their own.