When a hosting provider changes region: what it costs to be wrong
When a hosting provider changes region, the contract — not the provider's announcement — decides what happens next. This is what it costs to be wrong: the notice period, the right to object, and the ability to prove compliance to your own customers. The clock runs whether you read the notice or not.
The basis
A change of hosting region is first a contract event, not a regulatory one. Most of the obligations that matter live in the service agreement and the data processing addendum, not in a single statute picked off a shelf.
Where your organisation falls within the scope of Directive (EU) 2022/2555 (NIS2), the move is also a supply-chain event. NIS2 treats a change in a provider's infrastructure as a risk to be managed, not merely noted after the fact.
Any transfer of personal data to a new location is governed by the data protection regime that applies to your organisation. That regime, not the hosting contract, sets the conditions for moving data outside a recognised protection area. The contract only tells you when you found out and how long you have to react.
What changes in practice
The region change itself rarely breaks anything on the day it happens. What breaks is the sequence: the clock that started running before you noticed, the register that fell out of date, the disclosure you owed a customer and missed.
| What happens | What it typically triggers | Whose clock starts |
|---|---|---|
| Region change within the same legal area | Usually a listed permitted change | Provider's notice clock |
| Region change to a different legal area | Consent requirement or an objection window | Your objection clock |
| Change affects a subprocessor you disclosed downstream | Duty to update your own subprocessor register | Your customer-facing clock |
| Change alters the security posture of the infrastructure | Risk-assessment duty under an applicable cybersecurity framework | Your compliance clock |
What to do
- Locate the change-of-region clause in the service agreement and the data processing addendum. Contract owner.
- Confirm the date of the provider's notice and start the objection or consent clock from that date, not from the date you read it. Contract manager.
- Map the new region against your existing data-location and subprocessor commitments. Privacy lead.
- Check whether the change is a listed permitted change or requires fresh consent under the agreement. Legal.
- Update your own subprocessor and infrastructure disclosures to downstream customers before the move takes effect. Compliance.
- Record the review and the decision taken, even where the answer is no action. Contract owner.
Who decides
Internally, whoever owns the contract decides whether the change is permitted, and on what evidence: the clause text, the notice date, and any impact assessment on record. Where the contract is silent or contested, the forum is whatever dispute-resolution clause the agreement names. Nothing in this situation moves that forum for you.
The deadline that matters is contractual, not statutory. It is fixed by the notice period the agreement sets, not by a number of days written into a law. Read the clause before you calculate anything.
If it's more complicated
If the provider is your subprocessor under a data processing agreement, the region change also triggers your own duty to notify your customers before the move takes effect, not after it.
If the new region sits outside a jurisdiction your data protection regime recognises as offering equivalent protection, the change needs an additional transfer safeguard before data moves, not a retrospective fix once it already has.
If the contract is silent on region at all — more common in older technology agreements than in new ones — the gap resembles the one buyers meet When a collection uses third-party artwork step by step: an unaddressed provenance question that only surfaces once something has already gone wrong.
Related situations
The same discipline — read the clause before you react to the notice — applies when other technology-contract terms are tested, for instance When the customer refuses a limitation of liability and.
What this page does not decide
This page describes the contractual and regulatory mechanics of a hosting region change. It does not itself check whether your counterparty's own subprocessors are properly registered; that check is the Counterparty report when a subprocessor is added in detail.
It does not prepare or file paperwork with a regulator or registry either; that task belongs to the Document report before filing with an office step by.
Verified
Reviewed for accuracy at the time of publication. Primary source referenced above: Directive (EU) 2022/2555 (NIS2). Our retention rule for the underlying file — the report, the extracts and our copy — is set out at Retention: the report, the extracts and our copy.
FAQ
What is the first step when a hosting provider changes region?
Locate the change-of-region clause in the service agreement before you re-read the provider's notice. The clause, not the notice, tells you whether consent is needed.
Which deadline is already running?
The notice period set by the contract starts on the date the provider gave notice, not on the date you opened the message. Confirm that date first.
Who decides, and on what evidence?
The contract owner decides, based on the clause text, the notice date, and any impact assessment on record. If the contract is silent, its dispute-resolution clause names the forum.