Does German law require data to be stored in Germany?
Generally no. EU law forbids member states from restricting the free movement of personal data within the EU, and bans localization rules for non-personal data unless they are justified on public security grounds. The German rules that do set location conditions, for statutory health data and for tax records, accept storage anywhere in the EU. Requirements to keep data in Germany usually come from customer contracts, public tenders or internal policy rather than from a statute.
The EU baseline
Two EU regulations limit what Germany can require:
- Personal data: Article 1(3) of the GDPR states that “the free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.”
- Non-personal data: Article 4(1) of Regulation (EU) 2018/1807 states that “data localisation requirements shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality.”
The GDPR sets its location conditions at the EU and EEA border. Inside it, a data center in Frankfurt, Amsterdam or Helsinki is legally equivalent for data protection purposes. The distinction between location and jurisdiction is explained in data sovereignty vs data residency.
German rules with location conditions
| Area | Rule | Where the data may be |
|---|---|---|
| Statutory health and care data in the cloud | § 393 SGB V | Germany, another EU member state, a state treated as equivalent under § 35(7) SGB I, or a third country with an EU adequacy decision; the processing body needs a branch in Germany |
| Tax-relevant books and records | § 146 AO | Germany or one or more EU member states; outside the EU only with approval from the tax office |
| Federal administration | BSI minimum standard for the use of external cloud services | Its central requirement is security, not location: federal bodies must apply the C5 criteria when procuring cloud services for official data |
| Classified information | Federal classified information directive (VS-Anweisung) | Separate security rules for approved systems, beyond the question of location |
Two of these deserve a closer look.
Health data. § 393 SGB V applies to doctors, hospitals, statutory health and care insurers and their processors. Besides the location rule, it requires a current C5 attestation for the cloud systems used, Type 2 since 1 July 2025, and the implementation of the complementary customer criteria from the audit report. See what is BSI C5.
Tax records. § 146(2) AO starts from the principle that books are kept in Germany, but § 146(2a) allows electronic books and records in one or more other EU member states, provided the tax authorities have full data access. Storage outside the EU needs a written or electronic application and approval under § 146(2b). Moving records to a third country without approval can lead to a penalty (Verzögerungsgeld) of EUR 2,500 to 250,000 under § 146(2c).
Why “hosted in Germany” requests are common
Most Germany-only requirements come from somewhere other than a statute:
- Customer contracts and tenders that name Germany even where no statute does.
- Works council agreements for employee data, which sometimes specify a location.
- Risk assessments in which a German or EU-owned operator is the actual concern, and the location requirement stands in for a jurisdiction requirement.
The last case is common. A cluster in a German region of a US-owned provider meets a Germany-only clause, but does not answer the question of foreign government access. That question is covered in does the US CLOUD Act apply to data stored in the EU. When a contract asks for Germany, it helps to ask which risk the clause is meant to address.
How other member states compare
Other member states work within the same EU limits, and their stricter rules also tend to target jurisdiction rather than location. France is the clearest example. Under Article 31 of its SREN law of 21 May 2024 and an implementing decree of April 2026, state administrations that use a commercial cloud for sensitive data must use services protected against non-European law, in practice those qualified under SecNumCloud. These schemes are compared in what is a sovereign cloud. For a provider-by-provider overview, see the guide to cloud sovereignty, data residency and portability.
Running Kubernetes in Germany with Cloudfleet
Cloudfleet offers the control plane region europe-central-1a in Frankfurt, Germany, where cluster state and its backups stay, and all staff with production access are located in Germany, as described in Security and data protection. Your nodes and the data on them can run in German regions of supported cloud providers or in your own data center through self-managed nodes.