united-kingdom gdpr
Am I allowed to use US web hosting according to GDPR
<p>I live in UK, and I own a super simple website (web blog). The users of my website are not required to log in or provide any kind of personal information, they are just readers of my content.</p>
<p>I used to be under the impression that I do not need to worry about GDPR, but articles like <a href="https://law.stackexchange.com/questions/77282/under-the-gdpr-in-germany-is-a-privacy-policy-required-when-not-tracking-any-pe">this one</a> lead me to now believe otherwise. What concerns me even more is that my hosting provider is a US company, and the server is physically located in US. So all user information like IP addresses and browser specifications is stored and processed in US.</p>
<p>Is it even legal for me to use a US web server, seeing that US is considered an &quot;unsafe&quot; environment by GDPR? What are the measures that I need to take to ensure it's legal?</p>
<p>And one extra question: If I want introduce the ability for my users to login and comment on my website, will I be able to use a US database to store user emails and comments?</p>

<p>I'd rather not, but this might be compliant if you make sure that the personal data under your responsibility remains secure and protected even if it is processed abroad.</p>
<p>Since the UK has left the EU, it is sometimes necessary to distinguish between implications of the EU GDPR and the UK GDPR. These are functionally equivalent, but in the matter of international data transfers the practical details have diverged.</p>
<p>In <a href="https://law.stackexchange.com/a/77286">my answer</a> that you cited, I argued that any website processes personal data, and is thus potentially in-scope for the GDPR. If you cause another organization to process this personal data outside of the UK, you are performing an international data transfer (called “restricted transfer” in UK guidance). For example, such non-UK processing occurs if you use cloud services that run outside of the UK.</p>
<p>The UK ICO has <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/#adequacy" rel="nofollow noreferrer">guidance on international data transfers</a>. As in an EU GDPR context, you can only perform the transfer if the data remains suitably protected, or one of the exceptions applies. The data remains suitably protected if the target country was attested and “adequate” level of data protection, or if you have implemented appropriate safeguards.</p>
<p>As of 2022, the list of countries considered adequate is generally equivalent to the EU list of adequacy decisions. Notably, the US is no longer on that list after the Schrems II decision that invalidated the Privacy Shield Agreement. Since this decision was made before Exit Day, it also applies in the UK.</p>
<p>This leaves “appropriate safeguards” for UK→US restricted transfers. In the linked ICO page, read the section <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/#appropriate" rel="nofollow noreferrer">Is the restricted transfer covered by appropriate safeguards?</a>. In brief, you will need to perform a Transfer Impact Assessment, and sign Standard Contractual Clauses with the US data importer.</p>
<ul>
<li><p>In a Transfer Impact Assessment (TIA), you check that the data remains protected despite the transfer into a country without an adequate level of data protection.</p>
<p>There is no official guidance on conducting a TIA, but the <a href="https://iapp.org/resources/article/transfer-impact-assessment-templates/" rel="nofollow noreferrer">IAPP has a template</a> and the EU EDPB has <a href="https://edpb.europa.eu/sites/default/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf" rel="nofollow noreferrer">recommendations on supplemental measures to protect data transfers</a>, which might reduce the risk and affect a TIA in your favor.</p>
<p>It's worth noting that the EDPB recommendations were written in the wake of the Schrems II ruling, and can be summarized as “compliance is impossible when using US-based cloud services”. But this is your assessment, and TBH it seems the UK is a bit more relaxed than the EU in this regard.</p>
</li>
<li><p>The Standard Contractual Clauses (SCCs) are a pre-formulated contract that binds the foreign data importer to handle the data properly. In essence, this translates relevant aspects of the UK GDPR into contract law.</p>
<p>Many service providers already provide a Data Processing Agreement that includes SCCs by reference, but you'll have to make sure that these contracts have been entered in a legally binding manner. Sometimes these apply automatically as part of the terms of service, sometimes you need to explicitly sign these documents.</p>
<p>But SCCs are one detail where UK GDPR compliance and EU GDPR compliance diverges a bit. The old EU SCC templates from 2004/2010 can no longer be used and have been replaced.</p>
<p>For compliance with the EU GDPR, the new <a href="https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en" rel="nofollow noreferrer">2021 SCCs</a> must be used.</p>
<p>For compliance with the UK GDPR, you have <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/" rel="nofollow noreferrer">two options</a>. You can either use the 2022 International Data Transfer Agreement (IDTA), or you can use the 2021 EU SCCs along with the 2022 UK International Data Transfer Addendum which modifies the EU SCCs in some details.</p>
</li>
</ul>
<p>Don't want to deal with TIAs and SCCs? Switch to a hosting provider that only processes the personal data under your control in the UK, or in a country with an adequacy decision (e.g. EU, Canada, Israel).</p>
