When cloud region changes after signature: what to do first
The first step is not to renegotiate. Pull the contract's data-location clause, the change notice the provider sent, and any transfer mechanism it names. Confirm which entity now controls the new region, whether your existing risk assessment still holds, and whether a deadline started running the day the notice arrived rather than the day you read it.
Basis
A data-location clause is a contractual promise, not a statutory one. Its breach is judged against the contract, not against a specific article. Where your organisation falls within the scope of Directive (EU) 2022/2555 (NIS2), a change in hosting region that alters your risk exposure engages the cybersecurity risk-management measures the directive requires you to keep current. The directive does not freeze that assessment at signature; it expects it to track reality. Cross-border transfer safeguards, and any duty to notify a supervisory authority or the individuals concerned, sit outside NIS2 and are governed by the applicable data protection framework. This page works from the contract and from NIS2 where it applies. It does not restate obligations that belong to that separate framework.
What changes in practice
Three deadlines can move at once, and none of them pauses because the change came from the vendor's side.
| Deadline | Starts when | Who tracks it |
|---|---|---|
| Contractual notice period | The date on the provider's change notice | Legal team |
| Internal risk reassessment | The date your organisation learns of the change | Security lead |
| NIS2 risk-management update | The date the new topology takes effect, where NIS2 scope applies | Security lead, recorded in the risk register |
A short notice period read too late looks the same as no notice at all. Treat the date of the provider's message as the trigger, not the date someone opens it.
What to do
- Legal team retrieves the current contract and the change notice, and calendars every deadline named in either document.
- Security lead compares the new region against the transfer mechanism the contract names, and records any gap in writing.
- Security lead updates the risk assessment where NIS2 scope applies, dating the entry to the change itself.
- Procurement owner requests written confirmation from the provider naming the new region and the date it took effect.
- Legal team assesses whether the change breaches a data-location warranty, and what remedy the contract allows.
- Where a reseller or sub-processor sits between you and the provider, procurement traces which entity actually made the change.
Who decides
The provider's notice, read against the contract, decides whether the change was permitted at all. Where NIS2 risk-management duties apply, your own risk assessment decides whether the new region is acceptable, not the provider's assurance that it is. A supervisory authority becomes the decision-maker only once a formal question is raised under the applicable data protection framework, and that procedure sits outside this page.
Different situations, different next step
If your contract runs through a reseller rather than the provider directly, the reseller's own terms may set a shorter notice period than you expect. See When a reseller signs terms you never saw and what that means for the clock already running.
If the provider's terms name a supplier indemnity for this scenario, and it refuses to honour it, the dispute moves onto separate ground. See When a supplier refuses an indemnity and the deadline that follows from that refusal.
If a lender or investor holds security over your rights under the contract, a region change can trip a covenant nobody drafted for this. See When a pledge over rights is enforced and its knock-on effect on the underlying contract.
If the service itself is offered to customers in several countries, and the region change affects the offer rather than the hosting alone, a different compliance order applies. See When the offer targets several countries step by step.
What this page does not cover
This page does not decide whether the new region breaches a cross-border transfer safeguard, does not draft a notification to a supervisory authority, and does not price a contract renegotiation. It orders the first moves. Mapping the actual transfer route your data now follows is separate work.
Verified
Reviewed 4 March 2025. Primary sources: Directive (EU) 2022/2555 (NIS2), and the contract terms in force between your organisation and the provider, read directly rather than summarised.
Related: When children's data appears in the product in practice.
FAQ
What is the first step when cloud region changes after signature?
Pull the contract's data-location clause and the provider's change notice. Calendar every deadline either document names, starting from the date the notice was sent, not the date it was read.
Which deadline is already running?
The contractual notice period the provider owed you, and, where NIS2 scope applies, the update to your own cybersecurity risk assessment. Both start on the date of the change itself.
Who decides, and on what evidence?
The contract and the provider's notice decide whether the change was permitted. Your own risk assessment, where NIS2 applies, decides whether the new region is acceptable to your organisation.