"Our data is in the cloud" is not an answer to the question of where your data sits. In an audit, a tender, or with a procurement department asking for your data processing agreement, that difference suddenly matters.

What the GDPR does and does not say

The GDPR does not forbid your data from sitting outside the Netherlands. What the law asks is that you know where it sits, that you have a processing agreement with the party handling it, and that transfers outside the EU have appropriate safeguards.

In practice companies do not trip over the law itself but over simple questions. Which party holds it? Is any of it in the United States? Who can access it? How long do you keep backups? If you cannot answer those four from memory, an audit costs you a week.

Our servers are in the Netherlands. That is not sentiment: it means those four questions have short answers, and that someone can get in a car when hands are needed.

Availability is not the same as recovery

Large platforms promise availability: it runs, or they credit your monthly bill. What they usually do not promise is recovery. Lose data through an employee mistake or through ransomware and many terms explicitly make that your problem.

A backup that has never been restored is not a backup but an assumption. So we periodically restore one for real, onto an empty environment, and check that everything is there. It is dull work and it is the only moment you discover a table stopped being included three months ago.

What you should arrange yourself

Regardless of who hosts you:

  1. The domain and the hosting accounts in your own company's name, not your agency's.
  2. A processing agreement with everyone handling personal data. Your mail provider included.
  3. Knowing how long backups are kept and how quickly you can get one back.
  4. Rehearsing a restore yourself once a year. That is the test that counts.

What a migration costs

Usually less than people expect, and it happens outside office hours. On an agreed evening we move the last data across and redirect the traffic. If anything does not go as intended it is back on the old environment within minutes.

The biggest cost is almost never the move itself. It is working out which accounts turn out to exist and who owns them.