GDPR does not require that your content be cached inside the European Union. It requires that you know where personal data goes, under which legal mechanism it crosses borders, and who can reach it. For a GDPR CDN review, that distinction matters: a JPEG on an edge node in São Paulo is usually not personal data, while the access log recording who requested it almost always is. Article 83 puts unlawful transfers in the higher fine tier — up to 20 million euros or 4% of worldwide annual turnover — and the exposure in most delivery stacks sits in the log pipeline, not the cache.
Four obligations do the real work. Chapter V (Articles 44–49) governs transfers of personal data outside the EEA and requires a valid mechanism: an adequacy decision, Standard Contractual Clauses in the 2021 module form, or a derogation. Article 28 makes your CDN a processor and requires written instructions, an authorised sub-processor list, and a change-notification and objection process. Article 30 requires records that describe actual data flows, including recipient countries. Article 33 gives you 72 hours from awareness to notify a supervisory authority, which means your provider's breach-notification clause has to be measured in hours, not "promptly".
Two dates anchor the transfer question. In July 2020 the Court of Justice of the European Union invalidated Privacy Shield and required case-by-case assessment of transfers under SCCs. In July 2023 the European Commission adopted the EU-US Data Privacy Framework, restoring an adequacy route for certified US recipients. If your provider relies on the framework, verify the certification covers the specific legal entity named in your data processing agreement, not a parent company.
Most teams audit layer one and stop. The audit that survives a regulator's question covers all five.
| Layer | Personal data? | Common default | What to require |
|---|---|---|---|
| Cached objects | Only if responses are personalised or authenticated | Global caching, no region constraint | Per-property EU-only delivery for personalised paths; private or no-store elsewhere |
| Access logs | Yes — client IP, user agent, referrer, cookies | Aggregated into one storage region, 30–90 day retention | EU log sink, retention set to 7–30 days, IP truncation or salted hashing at ingest |
| Control plane and dashboard | Yes — admin identities, API audit trails | Single home region, often outside the EEA | Documented region plus the transfer mechanism covering it |
| Support and remote access | Yes — engineer views EEA logs from a third country | Follow-the-sun teams, undocumented | Named jurisdictions, access logging, optional EU-staff-only tier |
| Sub-processor chain | Inherited from all of the above | Public list, silent updates | Written notice window (30 days is typical) plus a contractual objection right |
Remote access by support staff outside the EEA is a transfer under Chapter V even when no byte is copied, and it is the layer most often missing from Article 30 records.
For a CDN, the GDPR exposure concentrates in the log pipeline rather than the cache. Request logs carry client IP addresses, which the Court of Justice of the European Union treated as personal data in its 2016 Breyer ruling, and most CDN log pipelines ship every line to one storage region regardless of where the request was served. Under Article 83, unlawful transfers carry administrative fines of up to 20 million euros or 4% of global annual turnover, whichever is higher.
Pinning delivery to EU edge regions is not free. A user in Singapore served from Frankfurt instead of a local edge typically sees time-to-first-byte move from roughly 25–60 ms to 220–320 ms in 2025-era measurements, and that is before TLS. QUIC with 0-RTT resumption hides part of the handshake cost, not the round trip itself.
Cache hit ratio moves too, but usually upward: concentrating the same request volume on fewer edge regions raises per-node object popularity. The trade you are actually making is tail latency for non-EU users against a defensible transfer story. Split the property. Public static assets go global; authenticated APIs, signed media manifests and anything with a session cookie stay EU-only.
The failure mode nobody tests: overflow behaviour. Several residency configurations fail open, routing to the nearest available capacity when the constrained region is saturated or in maintenance. That is a silent Chapter V event. Ask for the behaviour in writing and ask whether the alternative is a hard fail with a 503.
Flexible per-property configuration is what turns those answers into something enforceable; providers built around that model, BlazingCDN among them, let you separate a globally cached asset path from an EU-constrained authenticated path without running two contracts. If you are scoping this at the architecture level, the reference material on custom enterprise CDN infrastructure covers the configuration surface worth requesting.
Three checks, all doable this week. First, request a personalised path from an EEA client and a non-EEA client and compare whichever response header your provider uses to expose the serving node or region — if the non-EEA request is served locally, your residency rule is not applied to that path. Second, open your log destination configuration and confirm the storage region and retention value, then compare both against what your Article 30 record claims. Third, pull the current sub-processor list and diff it against the version attached to your signed DPA.
No. GDPR regulates transfers of personal data, not the physical location of every cached byte. Public static assets with no personal data can be cached anywhere. Personalised responses, authenticated content and access logs need a valid Chapter V mechanism — adequacy, Standard Contractual Clauses, or a derogation — and EU-only delivery is one way to avoid needing one.
Yes, in nearly all delivery scenarios. The Court of Justice of the European Union held in 2016 that dynamic IP addresses are personal data for a party with legal means to identify the subscriber. Truncating IPv4 to the /24 or hashing with a rotating salt reduces re-identification risk but does not automatically remove the data from GDPR scope.
Article 28(3) sets the minimum: processing only on documented instructions, confidentiality obligations, Article 32 security measures, sub-processor authorisation terms, assistance with data subject requests and breach notification, deletion or return at contract end, and audit rights. For CDN data residency specifically, add named storage regions, configurable log retention, and support-staff jurisdictions.
Non-EU users pay the round trip. Time-to-first-byte for an Asia-Pacific client served from Central Europe typically lands around 220–320 ms versus 25–60 ms from a local edge in 2025 measurements. Cache hit ratio usually improves because request volume concentrates on fewer nodes. Split traffic by path so only personal-data-bearing routes carry the latency cost.
Pick your highest-traffic authenticated path and trace one request end to end: serving region, log ingest, log storage, analytics warehouse, and every human who can query it. Write down the country at each hop. Most teams find at least one hop that never made it into their Article 30 record — usually the analytics sink or a support tooling account. Fix that mapping first, then negotiate retention and fail-closed behaviour at renewal. It is cheaper than discovering the gap during a supervisory authority inquiry.