Where Is Your HR Data Processed? Questions to Ask Your Provider

Choosing an HR platform means understanding where employee data is stored, who can access it and which safeguards apply. A clear answer should cover the database, documents, backups, support access and connected services.

Fact-checked on 21 September 2026.

EU hosting and GDPR compliance are different questions

EU hosting can be a useful procurement requirement. It does not establish compliance on its own, and the GDPR does not impose a general ban on storing or processing personal data outside the European Economic Area. International transfers need a valid Chapter V route alongside the other requirements that apply to the processing. EDPB: international data transfers

Ask the provider to distinguish its registered office from its processing locations. An EU company may use infrastructure or support teams elsewhere. A server address alone also says little about who holds the encryption keys or can access the records remotely.

What changed after Schrems II?

The 2020 Schrems II judgment invalidated Privacy Shield but upheld Standard Contractual Clauses as a transfer tool, subject to the required assessment and protections. SCCs are not a blanket approval of every transfer: the parties must examine whether they work in the circumstances and use supplementary measures where needed. EDPB: supplementary measures

The Commission adopted the EU–US Data Privacy Framework adequacy decision in 2023. It covers transfers to participating US organisations within the scope of their certification. Verify the recipient's current listing and whether it covers the relevant data, including HR data where applicable. European Commission: EU–US transfers

In September 2025, the General Court dismissed the challenge in Latombe v Commission, assessing the decision at the time it was adopted. That judgment should not be described as a guarantee about future litigation or government policy. Check the current adequacy position when making a procurement decision. General Court: Latombe judgment

What does the CLOUD Act mean for a buyer?

The CLOUD Act clarified that providers subject to relevant US legal process may have to disclose data in their possession, custody or control even when it is stored abroad. This is not unrestricted access to every overseas database, and incorporation alone does not answer every jurisdiction or control question. US Department of Justice: CLOUD Act explanation

Useful follow-up questions are: which entity can access the data, who controls the keys, how are government requests reviewed, and what notice can the provider give? Those answers are more informative than a promise that a company or server location eliminates every legal risk.

Ask for a complete processing map

Request the following before choosing a platform:

• The location of the primary database, documents and backups.
• The legal entities providing hosting, email, AI, support and billing.
• Any remote access or onward processing outside the EEA.
• The transfer mechanism used for each relevant recipient.
• The contract terms for sub-processor changes, export and deletion.
• Evidence supporting encryption, access controls and recovery claims.

Separate application data from billing data, but do not assume billing information is anonymous. A named account owner's contact details can still be personal data. Optional integrations should be assessed for the information they send as well as the information they receive.

How to use the answers

Keep the provider's DPA and processing disclosures with your assessment. Record any requirement that matters to your organisation, such as a particular hosting region or restriction on support access. Ask for unresolved points in writing before relying on a general “EU-hosted” label.

For PersoHR, start with our security measures, Data Processing Agreement and sub-processor list. These documents describe different parts of the service and should be read together. A complete account of the data flow is more useful than a claim that geography alone makes a product compliant.