Data residency · Q3 2026
UK law does not require your data room to be in the UK.
It requires something more specific, and less intuitive. What matters is not where the server sits but whether a restricted transfer is happening, and by the ICO's own test, giving an overseas bidder access to a UK-hosted room is a restricted transfer even though the documents never move.
- 9
- Offer UK residency
- 9
- UK office, no UK hosting
- 20%
- Of the total score
What the law actually says
UK GDPR is EU GDPR as retained in UK law under section 3(10) of the Data Protection Act 2018, sitting alongside the Act itself. Neither contains a data residency requirement.
The operative concept is the restricted transfer. On the ICO's test, one occurs where UK GDPR covers your processing, you send personal data or make it accessible outside the UK, and the receiver is a separate legal entity. Every restricted transfer must be covered by UK adequacy regulations, appropriate safeguards, or a derogation.
Two consequences follow that most buyers have backwards. First, granting an overseas bidder access to a UK-hosted data room is itself a restricted transfer, so UK hosting alone does not solve the problem it is usually bought to solve. Second, hosting abroad within your own legal entity is not a restricted transfer at all.
The framework also moved recently. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, with most data protection provisions commencing on 5 February 2026. It does not replace UK GDPR. It introduces new Articles 45A and 45B and a data protection test: protection in the destination must be not materially lower than UK standards, assessed taken as a whole. The same test now applies to exporters relying on standard contractual clauses.
Who offers UK data residency
A named, selectable United Kingdom storage location. Not a UK office, not a UK phone number, not UK GDPR language in a privacy policy.
| Provider | UK hosting | Where the data sits | UK office | Residency score |
|---|---|---|---|---|
| Papermark | ✓ Offered | Hosted in Europe by default, in eu-central-1 in Frankfurt, with a US region in us-east-1 also available. | No | 9.0 |
| ProjectfusionUK HQ | ✓ Offered | UK-only hosting is offered for government and regulated industries, alongside EU options and custom global setups. | Yes | 9.6 |
| Sterling TechnologyUK HQ | ✓ Offered | Clients can choose EU, UK or US data hosting, in what Sterling describes as logically and physically separate environments. | Yes | 9.3 |
| Intralinks | ✓ Offered | Data centres in the United States, the United Kingdom, Germany, Japan and Australia. | Yes | 8.0 |
| Safelink | ✓ Offered | Data centres across five jurisdictions: the UK, the EU, Australia, the US and the Channel Islands. | Yes | 8.6 |
| Digify | ✓ Offered | Amazon Web Services, with nine selectable file locations: the United States as default, Canada, Australia, India, Indonesia, Singapore, Ireland, the United Kingdom and the UAE. | No | 7.5 |
| KahootzUK HQ | ✓ Offered | United Kingdom, as declared on the G-Cloud 14 framework. | Yes | 8.8 |
| Nine23UK HQ | ✓ Offered | United Kingdom, declared on G-Cloud 14, in UK sovereign FSC and PASF accredited data centres. | Yes | 9.8 |
| BeamprobeUK HQ | ✓ Offered | UK or EU data residency claimed, with data stated never to move outside the UK or EEA. | Yes | 8.0 |
| Admincontrol | ✗ Not offered | Stack Infrastructure OSL 01 and 02 in Oslo, plus Microsoft Azure North Europe, West Europe, Norway East and Sweden Central. | Yes | 6.0 |
| Datasite | ✗ Not offered | Servers in the United States, Australia and Germany. | Yes | 6.0 |
| Drooms | ✗ Not offered | Germany and Switzerland only. | Yes | 5.5 |
| Virtual Vaults | ✗ Not offered | Microsoft Azure, with data stored twice and 99. | Yes | 3.5 |
| Ansarada | ✗ Not offered | Amazon Web Services. | Yes | 4.0 |
| SecureDocs | ✗ Not offered | Amazon Web Services. | Yes | 3.8 |
| Imprima | ✗ Not offered | All data, both primary and backup, is stored in EU locations on Microsoft Azure. | Yes | 5.5 |
| Firmex | ✗ Not offered | Amazon Web Services with customer-selectable document storage in the EU (Germany), Canada or the United States. | Yes | 5.5 |
| LegaticsUK HQ | ✗ Not offered | Amazon Web Services, in the United States, EU, Australia and other regions. | Yes | 5.0 |
A UK office is not UK hosting, and the gap is wide
9of the providers assessed have a UK office, a UK registered entity, or both, and do not offer UK data residency. In at least one case the same company holds UK government-facing certifications and sells through a UK procurement framework while hosting exclusively outside the UK. None of that is improper. It is simply not what most buyers assume when they read the words "London office" on a comparison page.
Questions worth settling first
Does UK law require a data room to be hosted in the UK?
No. UK GDPR is EU GDPR as retained in UK law under section 3(10) of the Data Protection Act 2018, and it contains no residency requirement. The test it applies is whether a restricted transfer is taking place, and if so whether that transfer is covered by adequacy regulations, appropriate safeguards or a derogation.
What counts as a restricted transfer?
Under the ICO's test, a restricted transfer occurs where UK GDPR covers your processing, you send personal data or make it accessible outside the UK, and the receiver is a separate legal entity. The phrase that catches people out is 'make it accessible'. Granting an overseas bidder access to a UK-hosted data room is itself a restricted transfer, even though the documents never leave the UK.
Is EU hosting the same as UK hosting?
No, and this is the most common error in this market. Since Brexit the UK is a third country to the EU and the EU is a third country to the UK. Transfers to the EEA are covered by UK adequacy regulations, so EU hosting is lawful and straightforward, but it is not UK hosting, and a contractual or regulatory requirement that specifies the United Kingdom is not satisfied by Frankfurt.
Does the FCA require UK-only hosting for financial services?
No. FCA guidance FG16/5, published in July 2016 and updated in September 2019, asks firms to agree a documented data residency policy with the provider and to avoid jurisdictions that would inhibit access by UK regulators. It states explicitly that there is no fundamental reason why cloud services cannot be implemented compliantly. It does not mandate UK-only hosting.
Which providers actually offer UK data residency?
Of the providers assessed, a minority offer the United Kingdom as a named, selectable storage location. Several vendors with UK offices, UK accreditations and heavy UK marketing do not offer it at all. The table on this page separates the two.
This page summarises published guidance from the ICO, the FCA and legislation.gov.uk. It is not legal advice, and a transfer risk assessment for your specific transaction is not something a comparison site can do for you.