News

Data sovereignty: why it matters where your data is

Where data is hosted decides which law applies and who can access it. Criteria for SMEs in Andorra and Catalonia under the GDPR and Llei 29/2021.

Published By BDR Group11 min read

Where a company’s data is hosted determines which law applies to it, who can compel the provider to hand it over and how it is recovered if the service fails. For an SME in Andorra or Catalonia, knowing this is part of complying with data protection rules and of avoiding dependence on a single provider without realising it.

What data sovereignty means for an SME

Talking about data sovereignty means answering three questions with specific names: which country the data is physically in, which jurisdiction the company that holds it is subject to, and who can technically access it. Many contracts answer only the first.

The second is the one most often overlooked. US law requires providers of electronic communication and remote computing services to preserve or disclose, if they receive a request under that law, the data in their possession, custody or control, whether it is located inside or outside the United States (Title 18 of the United States Code, section 2713, added in 2018). A server in Frankfurt belonging to a US company still depends, on this point, on US law.

This does not make it unlawful to work with a US provider, but the location of the server does not, by itself, explain who can reach the information.

Andorra: outside the EU, with a recognised level of protection

Andorra is not in the EU, but the European Commission decided on 19 October 2010 that it ensures an adequate level of protection for personal data transferred from the Union (Decision 2010/625/EU). The General Data Protection Regulation (GDPR) keeps such decisions in force until the Commission amends them (Article 45(9)) and, as at 25 October 2026, Andorra remains on the list of countries with an adequacy decision. A transfer based on that decision needs no specific authorisation (Article 45(1)).

The decision has been reviewed: on 15 January 2024 the Commission concluded, in its first review of the eleven decisions adopted before the GDPR, that Andorra continues to provide an adequate level of protection, and noted that Llei 29/2021 is closely aligned with the GDPR.

On the Andorran side, the framework is Llei 29/2021 of 28 October, a qualified law on personal data protection (published in BOPA, Andorra’s official gazette, no. 119, on 17 November 2021). It prohibits international communications of data to countries without an equivalent level of protection (Article 42), which is determined by the EU list or by effective accession to the Council of Europe’s Convention 108+; transfers to EU members are provided for (Article 43). Outside those cases, adequate safeguards are required (Article 44).

For an Andorran company, sending customer data to a service hosted in a country that is neither in the EU nor covered by an adequacy decision is an international transfer that it must be able to justify. And if it offers goods or services to people living in the Union, the GDPR may also apply to it (Article 3(2)).

In Catalonia, the GDPR sets conditions for the provider

For a company in Girona or L’Hospitalet de Llobregat, the framework is Regulation (EU) 2016/679. Anyone who contracts a service that processes personal data on their behalf must choose a processor offering sufficient guarantees and regulate the relationship by contract (Article 28). The contract must state that the provider processes the data only on documented instructions, including as regards transfers to third countries, and that it deletes or returns the data at the end of the service. Nor may it use another processor without prior written authorisation.

It is common for a tax and accounting advisory firm or a clinic to have added online tools (email, storage, CRM, signature) without reviewing any contract, and for nobody to be able to say where the data is.

How to build the inventory of data and providers

A spreadsheet is enough to start with. The GDPR (Article 30) and Llei 29/2021 (Article 34) regulate the record of processing activities, with exceptions depending on the organisation and the processing; even if you are not required to keep one, it is the natural starting point.

For each system that stores data (email, ERP, CRM, files, accounting, signature, backups), note:

  • Who uses it and what data it holds: customers, employees, health, financial, covered by professional secrecy.
  • Which provider supplies it, which country it is established in and which group it belongs to.
  • Which country the data and the backups are in, and which sub-processors are involved.
  • Who holds the encryption keys.
  • Which processor contract applies and when it was last reviewed.
  • How the data is exported and whether the export has ever been tested.

What changes depending on the type of data

Sovereignty does not weigh the same for all data, and it is worth deciding by category.

Type of dataWhat the rules sayPractical consequence
Customer contact detailsProcessor contract and security appropriate to the risk (GDPR Arts. 28 and 32; Llei 29/2021 Arts. 31 and 35)Contract, sub-processors and backups are the minimum
HealthProcessing prohibited, with exceptions (GDPR Art. 9; Llei 29/2021 Art. 9); impact assessment if on a large scale (GDPR Art. 35(3)(b); Llei 29/2021 Art. 32(3)(b))Location, access and exit from the provider weigh more
Customers’ financial dataNot a special category (Art. 9), but security appropriate to the risk is required (Art. 32)Encryption, tested backups and access control
Covered by professional secrecyLlei 48/2014 defines it as a duty of the lawyer and a right of the client (Art. 13)The firm answers for it; choosing a provider is part of that

Banking and law firms in Andorra

The operating entities of Andorra’s financial system have an outsourcing rule in Llei 7/2024 of 27 May (Article 8). To outsource relevant operational functions, including IT systems, they must inform the Andorran Financial Authority (AFA) and obtain its prior authorisation, after analysing the provider, the risks and the contract clauses. Outsourcing does not release senior management or alter obligations towards customers, and the entity remains fully responsible for the provider.

A Catalan financial entity is subject to Regulation (EU) 2022/2554 (the Digital Operational Resilience Act, DORA), applicable since 17 January 2025: contracts with ICT providers must state the countries where the services are provided and data is processed, storage included, and ensure its recovery if the provider becomes insolvent or the contract ends (Article 30(2)).

For law firms, Llei 48/2014 of 18 December (on the practice of the legal profession and the Official Bar Association of Andorra) allows professional secrecy to be lifted only in the cases provided for by law, with the client’s express authorisation or, exceptionally, by reasoned decision of the Bar Association’s governing board. The law does not mention clouds. Our reading is that a firm that keeps its case files in an external service must be able to show where they are and who accesses them.

Questions to ask your provider

Before signing or renewing, ask in writing:

  1. Which legislation is the company subject to, including parent companies and subsidiaries?
  2. In which countries are the data and backups processed and stored, and how are you told of a change?
  3. Which sub-processors are involved and how can you object to a change (GDPR, Article 28)?
  4. Who holds the encryption keys? Can you use your own?
  5. What does it do if it receives a request from an authority in a third country? Regulation (EU) 2023/2854 (the Data Act), applicable since 12 September 2025, requires providers of data processing services to prevent unlawful access to and transfer of non-personal data held in the Union (Article 32).
  6. How do you leave? The same regulation requires a contract with a notice period of at most two months, a transition period of up to thirty days and at least thirty days to extract the data (Article 25); from 12 January 2027 no switching charges may be imposed (Article 29).
  7. Where are the backups and when was the last restore tested?
  8. How soon does it tell you about an incident? The controller has seventy-two hours to notify if personal data is affected (GDPR, Article 33; Llei 29/2021, Article 36).

Location does not solve everything: backups, keys and exit

Our position is that sovereignty is checked at three moments. Day to day: where the data is and under which law. The incident: if the backups are with the same provider and in the same account as the originals, one error or improper access can affect both at once. The exit: being able to recover the information in a usable format and within a reasonable time if you change provider.

A hotel in Andorra with its reservations on a foreign platform, backups on the same platform and no tested export depends entirely on a third party, and no clause shows it. Having the data nearby helps, but it does not replace a separate, tested backup. And if the encryption keys are held by the provider that hosts the data, they offer little protection against a request addressed to that provider.

Where we have an interest, and where we do not

We say it plainly: BDR Group offers managed cloud services through Andorra Cloud, with its own data centre in Andorra and a technical team in the Principality, so we have an interest in this debate. That does not make local hosting the answer for everything: some workloads run well in a public cloud and a hybrid environment is often the most reasonable option. The criterion should be the type of data and the risk of losing control of it, not the price of the first invoice.

What to do now

  1. Draw up an inventory of the systems that hold personal or critical data, with the country of the data and the country of each provider.
  2. Classify the data by sensitivity and decide where each group goes, instead of making a single decision for the whole company.
  3. Review the processor contracts: instructions, sub-processors, transfers and what happens to the data when the service ends.
  4. Identify transfers outside the EU (or outside Andorra and the EU, if you are an Andorran company) and the legal basis that covers them.
  5. Check that the backups are outside the main system and run a real restore test.

Frequently asked questions

If my provider has its servers in the EU, is that enough?

Not always. If the provider is subject to the law of another country, such as the US law cited above, that law may also have effects. You need to look at the contract and the jurisdiction.

Can a Catalan company host personal data in Andorra?

Yes. The European Commission considers that Andorra ensures an adequate level of protection, and a transfer based on an adequacy decision needs no specific authorisation. The processor contract is still mandatory.

Can an Andorran company use a cloud in an EU country?

Yes, Llei 29/2021 provides for transfers to EU members. Check services that, although contracted in Europe, send data to third countries.

Sources

Want to know where your company’s data is?

If you want to review where your information is hosted and what options you have in Andorra, start with the service page: Managed business cloud in Andorra

Back to News

News

Related articles