Guides / GDPR and Django hosting: what must stay in the EU? Django Cloud explains

Peter van Doorn Django Cloud · Checked against Django 4.2 and newer, October 2026

GDPR and Django hosting: what must stay in the EU? Django Cloud explains

A common myth says GDPR requires all personal data to stay in the EU. It does not. GDPR requires that personal data is protected wherever it goes. Keeping it in the EU is the simplest way to show that, which is why clients ask for it. This guide separates the rules from the habits. It is general information, not legal advice.

What GDPR actually requires

• A legal reason for processing the data, and only the data you need.
• A contract with every processor (Article 28). Your hosting provider, your email service and your error tracker are processors if they handle personal data for you.
• Security that fits the risk: encryption, access control, backups.
• A lawful basis for transfers outside the EU or EEA (Chapter V). This is the part that sounds like "data must stay".

When data leaves the EU

Sending personal data to a country outside the EU/EEA is allowed if one of these applies:

1. The EU has decided that the country offers adequate protection (an adequacy decision). The EU-US Data Privacy Framework is one for certified US companies.
2. You use approved contract clauses (standard contractual clauses) plus any extra safeguards.
3. A narrow exception applies, such as explicit consent for a one-off case.

These routes work, but they add paperwork. Many clients choose to avoid the question by storing data in the EU.

A practical Django checklist

1. Pick an EU region for the app and the database.
2. List your processors: hosting, email, analytics, error tracking, support chat, payment. Sign a DPA with each.
3. Check where each processor stores data. Email and error tracking are the usual leaks.
4. Scrub personal data from logs. A stack trace that prints a user's email address is personal data in a log system.
5. Delete data on request. Make sure a user deletion removes the rows, the backups on a schedule, and cached copies.
6. Keep a record. One page: what data, why, where, who has access.

The hosting part

Choose a European AWS region and keep the database there. On Django Cloud, the Data Processing Agreement describes how we handle personal data as a processor. See also Django hosting in the EU for what is stored where.

Or skip it

Django Cloud lets you keep your app and database in a European AWS region, and publishes a Data Processing Agreement that describes how we process personal data on your behalf.

pip install djangocloud-cli
djangocloud deploy

Get startedSee pricing

Free plans are available for students, AWS Activate startups, open-source, non-profit and research projects. See how Django Cloud compares with other ways to host Django.

Django is a registered trademark of the Django Software Foundation. Django Cloud is not affiliated with or endorsed by it. Found a mistake in this guide? Tell us and we will fix it.