Where Is Your Data Stored? A Guide to Data Storage in the EU and Belgium

For years, data storage was a technical detail. You bought enough capacity, kept a backup somewhere and moved on. That is no longer the case. For European businesses, data storage in the EU and Belgium has become a strategic decision with legal, security and business consequences. Belgian organisations now want clear answers: where exactly is our data stored, who can access it, and how fast can we get it back if something goes wrong?

Three forces are driving that question. European regulation now ties data storage directly to legal responsibility. Ransomware has turned backup and recovery into a board-level topic. And geopolitical uncertainty has made many companies rethink how dependent they are on providers outside the EU.

This article explains what the EU and Belgian rules actually require, what “storing data in the EU” really means, and how to build a storage setup that is compliant, resilient and easy to manage.

Which EU rules decide how you store data?

No single EU law says “all data must be stored in Europe”. Instead, several regulations together decide how you may store data, who you may trust with it, and how well you must protect it.

GDPR: it regulates transfers, not just location. GDPR does not impose a blanket rule that personal data must stay in the EU. What it does regulate is transfers outside the EEA. Storing data outside the EEA, processing it there, or giving someone outside the EEA access to it can all count as a transfer. In practice, keeping personal data in the EU removes a lot of legal complexity, but you still need to check backups, subprocessors and support access, not only the primary storage location.

NIS2: resilience becomes a legal duty. The NIS2 Directive requires essential and important entities to manage cyber risk and keep operating after a major incident. Backup, disaster recovery and crisis management are explicitly part of that. Management bodies must approve these measures and can be held liable if they fall short.

The Data Act: you can leave your cloud provider. Since 12 September 2025, the EU Data Act applies to cloud and other data processing services. Providers must remove obstacles to switching, whether to another provider or back on-premises. Switching charges are capped at the provider’s direct costs until 12 January 2027, and from that date they are banned altogether. This makes a clear exit plan a realistic part of every storage contract.

What does NIS2 mean for organisations in Belgium?

Belgium was one of the first countries to put NIS2 into national law, and supervision is already underway. The Belgian NIS2 law of 26 April 2024 entered into force on 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the competent authority.

A few Belgian specifics are worth knowing:

• Real fines. For important entities, fines can reach EUR 7 million or 1.4% of worldwide turnover. Essential entities face higher caps and proactive supervision.
• Management is accountable. Management bodies must approve the cybersecurity measures, including backup and continuity, and oversee how they are implemented.
• It reaches suppliers too. NIS2 entities must manage third-party risk, so they increasingly pass security requirements on to their IT and cloud providers. Even if your company is not in scope, your customers may be.

GDPR in Belgium is supervised by the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). Together, these rules mean a Belgian organisation should be able to answer three questions at any time: where is our data, who can reach it, and how quickly can we restore it?

What is the difference between data residency and data sovereignty?

“Our data is in an EU data centre” is a good start, but it is not the full answer. Two terms often get mixed up:

• Data residency is where your data physically sits: the country or region of the data centre.
• Data sovereignty is whose laws apply to that data, and who can be compelled to hand it over.

A provider headquartered outside the EU may still fall under foreign laws, even when the servers are in Europe. The EU-US Data Privacy Framework currently makes transfers to certified US companies lawful, but many organisations prefer not to depend on a single legal arrangement that has been challenged before. That is why a growing number of Belgian companies keep their most sensitive data in a private or EU-managed environment, and use public cloud for the rest.

When you evaluate any storage or cloud provider, ask these questions:

• In which country, and which data centres, is our data stored?
• Where are backups and replicas kept? Are they in a separate location?
• Who can access the data for support or maintenance, and from where?
• Which subprocessors are involved?
• How is the data encrypted, at rest and in transit, and who holds the keys?
• How fast can you restore our data, and when was that last tested?
• What does an exit look like? How do we get our data back if we switch?

Is data storage only about capacity?

The rules above share one theme: it is not enough to store data, you must be able to protect it and get it back. A sound storage strategy has four layers.

• Primary storage. Where your files, databases and applications live day to day: on-premises, in a private or shared cloud, or in a public cloud such as Microsoft Azure.
• Backup. A separate copy of your data, kept apart from the primary environment, so that a ransomware attack, a hardware failure or a human mistake does not take everything with it.
• Disaster recovery. A tested plan to restore systems and data quickly. A backup that has never been restored is a hope, not a plan.
• Management and monitoring. Someone watching capacity, security and backup jobs every day, and acting when something fails.

A common blind spot: Microsoft 365. Many Belgian companies store most of their documents in OneDrive, SharePoint and Teams. Microsoft keeps the platform running, but under its shared responsibility model, protecting against deleted files, malicious encryption or long-term data loss is largely up to you. An additional Microsoft 365 backup closes that gap.

How can ITAF help with storage, protection and recovery?

At ITAF, we see storage as more than “where do we put your data?”. It is also how that data is protected, monitored and recovered when something goes wrong. That is why we bring storage, backup, disaster recovery and management together in six areas.

Hybrid by design. Not every workload belongs in the same place. ITAF supports hybrid environments that combine existing on-premises servers, Private Cloud and Microsoft Azure. Sensitive data can stay on private servers while other workloads run in the public cloud, so you choose the right home for each type of data instead of forcing everything into one destination.

One partner for the whole chain. Because the same team manages your storage, your backups and your recovery plan, you get clear answers to the questions that NIS2, GDPR and your own customers keep asking: where your data is, who manages it, and how fast it comes back.

Where does your organisation stand today?

Use this checklist to see where you stand today:

• We know where all our business data is stored, including backups.
• We know which providers and subprocessors can access our data.
• Our backups are kept separately from our primary environment.
• Our Microsoft 365 data has its own backup.
• We have a disaster recovery plan, and we tested it in the last 12 months.
• We know whether NIS2 applies to us, or to our customers.
• We have an exit plan for each cloud provider.

Could you not tick every box? You are not alone, and it is easier to fix than you might think. Contact ITAF for a conversation about your storage, backup and recovery setup. Together we will map where your data lives today and build a storage environment that is compliant, resilient and fully managed.

Frequently asked questions

Does GDPR require my data to be stored in the EU?

Not strictly. GDPR allows personal data to leave the EEA, but only with an adequacy decision or approved safeguards. Keeping data in the EU makes compliance much simpler, because you avoid most transfer questions.

Does NIS2 apply to my company?

It depends on your sector and size. Medium and large organisations in sectors such as energy, transport, health, digital infrastructure, manufacturing and food are often in scope. In Belgium, the CCB can also designate entities directly. Even if you are out of scope, customers who fall under NIS2 may ask you to meet similar requirements.

Is Microsoft 365 data automatically backed up?

Microsoft keeps the service available and offers basic retention features. Protection against accidental deletion, ransomware or long-term data loss is largely your responsibility. A separate Microsoft 365 backup gives you an independent copy you can restore from.

What is the difference between backup and disaster recovery?

A backup is a copy of your data. Disaster recovery is the tested plan and process to get your systems and data running again after an incident. You need both: a backup without a recovery plan can still mean days of downtime.

Can I switch to another cloud provider later?

Yes. Under the EU Data Act, cloud providers must support switching, and from 12 January 2027 they may no longer charge switching fees. A clear exit plan is still wise, so your data and applications move smoothly.

Do I have to move everything to the cloud?

No. A hybrid setup lets you keep sensitive data on private servers while other workloads run in the public cloud. ITAF can combine on-premises servers, Private Cloud and Microsoft Azure in one managed environment.

How do I get started with ITAF?

Contact ITAF for a conversation about your current storage, backup and recovery setup. We start by mapping where your data lives today, then propose the right mix of cloud, backup and recovery services.

Book a free call