Data Residency After Brexit: Where Is Your Document Data Stored?

Data residency is a compliance consideration that many UK businesses underestimate when choosing a cloud DMS. Our document management GDPR compliance guide covers the full framework. This article covers the post-Brexit data residency question specifically.

What Changed After Brexit

Before Brexit, UK businesses could freely transfer personal data to any EU/EEA country and vice versa. After Brexit (specifically from 1 January 2021), the UK became a "third country" from the EU's perspective, and the EU became a "third country" from the UK's perspective.

In practice: the EU granted the UK an adequacy decision in June 2021, meaning personal data can still flow freely from EU to UK. The UK granted adequacy decisions to EEA countries, meaning data can flow freely from UK to EEA. But for transfers to countries outside UK/EEA (including the US, India, and many others), both EU and UK GDPR require additional safeguards.

Why This Matters for Cloud DMS

When you store documents in a cloud DMS, the data is held in data centres owned by the vendor or their infrastructure provider (typically AWS, Azure, or Google Cloud). Those data centres may be in the US, Ireland, Germany, Singapore, or anywhere else.

If your documents contain personal data about UK individuals (customers, employees, patients) and those documents are stored in data centres outside the UK/EEA — that's a restricted international transfer. You need to ensure it's covered by an adequate transfer mechanism.

UK Adequacy Decisions: Where Can Your Data Go?

The UK has recognised the following countries as providing adequate data protection (personal data can transfer freely):

• All EEA countries (EU member states, Iceland, Liechtenstein, Norway)
• Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, Uruguay
• USA: only for organisations certified under the UK-US Data Bridge (formerly Privacy Shield successor)

For countries not on this list, a transfer impact assessment and appropriate safeguards (UK Standard Contractual Clauses, binding corporate rules) are required.

What to Ask Your DMS Vendor

Before signing a DMS contract, ask:

1. Where are my documents physically stored? Not just "in the cloud" — specific data centre regions and countries.
2. Is UK data residency available as an option? Many enterprise vendors offer data residency selection at the account level.
3. What sub-processors do you use? Even if the vendor is UK-based, they may use AWS US East or similar for infrastructure. Their sub-processors are relevant to your transfer obligations.
4. Do you have a Data Processing Agreement that covers UK GDPR? Not just EU GDPR — UK GDPR is a separate legal instrument post-Brexit.
5. If data is transferred outside UK/EEA, what mechanism do you use? UK SCCs, binding corporate rules, or reliance on an adequacy decision.

Major Vendor Positions

Microsoft 365 / SharePoint: UK data residency available — data stored in Microsoft's UK South and UK West data centres. Requires selecting UK as your data location in the Microsoft 365 admin centre. Microsoft's DPA covers UK GDPR.

Google Workspace: UK data residency available for some products (Drive, Gmail) through Google's data regions feature. Check current coverage as it varies by product.

DocuWare Cloud: EU data residency standard; UK-specific data residency available on request. Check current terms.

US-headquartered DMS vendors: Many smaller DMS vendors are hosted on AWS or Azure US regions. Ask specifically about UK data residency — it may not be offered or may require a premium tier.

The Practical Test

Log into your current DMS or SharePoint admin console. Find the data location or data residency setting. Does it show UK or EEA? If it shows "United States" or an unspecified global location — you need to investigate whether adequate transfer safeguards are in place.

This isn't a theoretical risk. The ICO has the power to investigate international data transfers and has issued enforcement notices against UK organisations using US-hosted services without adequate transfer mechanisms.