When a hosting provider changes region: what to do first
A hosting provider moving your workload to a new region changes where the data sits, who can compel access to it, and which parts of the contract still say what you thought they said. Check the notice clause first, then the data-location clause, then the sub-processor list. Only after that decide whether the change needs escalation.
Basis
Directive (EU) 2022/2555 (NIS2) sets an EU-level expectation that in-scope entities manage risk arising from their supply chain, including hosting and cloud infrastructure. Whether a specific national duty attaches to a regional move depends on the implementing act in your jurisdiction, and that act sits outside this reference set. Treat the directive as context for why the question is being asked, not as the source of a duty in itself.
What changes in practice
A region change rarely breaks the service. It changes three things that matter for the contract: the legal regime governing the data at rest, the notice period the provider owed you before moving, and the sub-processor list you approved. If the new region sits outside the guarantees you negotiated, the gap is contractual, not technical, and it is fixed by reading the agreement, not by calling support.
| Signal | Why it needs a same-week review |
|---|---|
| Notice period already running or expired | Your right to object or terminate may lapse on a fixed date |
| New region outside the EU/EEA or an approved list | Transfer safeguards may no longer match what the contract promised |
| Sub-processor list changed without a named replacement | Approval clauses often require your sign-off before the change takes effect |
| Regulated data involved (health, financial, personal at scale) | A sector-specific duty may sit on top of the general contract terms |
What to do first
Work through the file in this order, and assign an owner to each step.
- Pull the notice the provider sent and confirm the date it was received, not the date on the letter.
- Have the contract owner locate the data-location and sub-processor clauses and read them against the new region.
- Ask the technical lead to confirm which datasets actually moved, since notices sometimes cover more infrastructure than is in scope for you.
- Have the contract owner calculate the objection or termination deadline from the clause, not from memory.
- Flag any regulated data category to the person responsible for compliance before the deadline, not after.
- Put the open question to counsel once the deadline and the gap are both identified, not before.
Who decides
Inside the company, the contract owner decides whether to invoke the objection right, on the evidence of the clause text and the notice date. Where the gap concerns regulated data, the decision moves to whoever holds compliance sign-off, on the evidence of the data category and the destination region. Neither decision needs a court; both need a paper trail showing what was read and when. Put the question to a partner explained once the internal review is done and a specific gap remains open.
Two scenarios
If the notice period has already run out, the objection right is likely gone, and the question becomes whether the new terms are still workable, not whether you can stop the move. If the notice period is still open, the priority is to send a written objection before it closes, since silence is usually read as acceptance.
A separate but structurally similar problem arises when a transfer is recorded on one ledger and not reflected in the paper record that should match it: see When a transfer on-chain is not recorded off-chain for the parallel review sequence.
Related situations
A regional move often surfaces the same underlying weakness as a disputed liability cap: a clause that was negotiated loosely and never revisited. See When the customer refuses a limitation of liability step for the adjacent sequence.
Sources and limit
This page covers the contractual review only: notice, location clause, sub-processor list, and deadline. It does not establish who controls the provider entity, and it does not itself gather evidence of the region change; those are separate exercises. For that, a structured factual check is a better tool than a contract clause: Counterparty in United Kingdom and its limits in detail covers what can be established about the provider itself.
Where the dispute turns on the wording of the notice or the contract copy in hand, a documentary check answers a different question than the clause does: Document in United Kingdom and the evidence sets out what such a check can and cannot confirm.
Verified
State on: current review cycle. Source referenced: Directive (EU) 2022/2555 (NIS2), EUR-Lex.
FAQ
What is the first step when a hosting provider changes region?
Confirm the date the notice was actually received, then read the notice, data-location, and sub-processor clauses against the new region before doing anything else.
Which deadline is already running?
The objection or termination window set by the notice clause, calculated from the date of receipt. Most contracts treat silence past that date as acceptance of the change.
Who decides, and on what evidence?
The contract owner decides on the clause text and notice date; where regulated data is involved, compliance sign-off decides on the data category and destination region.