Free flow of non-personal data

As an individual, business or organisation you have the right to use, collect, store, transfer or manage non-personal data, and to use data centres or cloud services anywhere in the EU.

This can help you avoid any potential duplication of costs; for example, you can centralise your IT infrastructure in one EU country, even if you operate in multiple countries.

Personal data, non-personal data and mixed datasets

Personal data is any information about an identified or identifiable person and follows GDPR rules.

Non-personal datasets refer to data which:

• does not relate to an identified or identifiable natural person, such as data on weather conditions
• was initially personal data, but was later made anonymous and cannot be attributed in any way to a specific person

Mixed datasets are collections of personal and non-personal data such as a company’s tax record, mentioning the name and telephone number of the managing director of the company. In most cases, the personal and non-personal data in mixed datasets are inextricably linked. If you handle such mixed datasets, you must follow GDPR rules.

You can store your data anywhere in the EU, including on cloud servers

Apart from the exceptional cases explained below, you can choose the location where data is stored or processed.

If you use a cloud service to store your data, EU data rules ensure that:

• You can easily switch to another cloud provider or restore your data to your own IT systems.
• Providers must give you your data in a common, machine-readable format and cannot create obstacles to switching.
• If you use infrastructure services (IaaS), the new provider must deliver comparable results for shared features, so your applications continue to work.
• Providers may charge limited costs for switching and for moving data out of a cloud services (egress). What they can charge is limited to the amount that they themselves spend on making a customer’s switching/egress possible.

Data localisation restrictions in the EU

In exceptional cases, EU countries may be able to restrict the movement of certain data, but only if justified on the grounds of public security. Such a justification could be, for example, when data relates to ongoing counter-terrorism investigations, or when loss of data could risk a major traffic accident (such as for air traffic control data). These exceptions depend on national legislation. The EU regulation on the free flow of non-personal data gives access to information about such data localisation restrictions.

Sharing data with competent authorities

You must make data available if a competent authority makes a legitimate request to access your data, even if the data is managed or stored in another EU country. Penalties may be issued for non-compliance in accordance with national law.

National information and contact points

EU rules on the free flow of non-personal data outlines two information points that EU countries must provide:

• “Single information point” refers to an official website with national information about the data localisation restrictions and requirements.
• “Single point of contact” refers to a physical address and/or an email that you can contact for further information.

You can find this information in the Ask national administrations section below.