Google Workspace: keep your data in Europe with data regions

Store your Google Workspace data in Europe

Google Workspace offers data regions that let you choose where to store your data at rest. For European businesses subject to the GDPR or to digital sovereignty requirements, this feature ensures that primary data stays within European territory. Configuration takes a few clicks from the admin console.

How data regions work

Google Workspace data regions let you define a storage policy at the organization level or by organizational unit. You choose between three options: Europe, United States or no preference (global distribution). The data at rest of the covered applications is stored exclusively in the chosen region.

Configuration is done from the admin console under Account > Account settings > Data regions. Changing the region triggers a migration of the existing data that can take several days depending on the volume. During the migration, users continue to work normally.

What’s covered and what’s not

Data regions cover the primary data at rest of Gmail (email bodies, attachments), Google Drive (stored files), Docs, Sheets, Slides, Forms, Sites, Chat (messages), Calendar (events), Vault (archived data) and Keep (notes).

Metadata (email headers, file names, timestamps) and service data (activity logs, search index) are not covered by data regions. This data can be processed in any Google data center for reasons of performance and functionality.

Data in transit travels over Google’s global network, encrypted end to end. Routing is optimized for performance, which means an email sent from Mulhouse to Paris may pass through a network node outside Europe before reaching its destination.

Digital sovereignty and GDPR

Data regions address part of the digital sovereignty requirements. They ensure that data at rest is stored in Europe, which simplifies compliance with regulations that require data localization.

However, digital sovereignty goes beyond storage. It also concerns access to data by foreign authorities (the US Cloud Act), control of encryption keys and the ability to switch providers. Google addresses these concerns with Client-Side Encryption, which lets you encrypt data with your own keys, and with transparency reports that detail government access requests.

Recommended configuration for French SMBs

For a French SMB, the recommended configuration is to select the Europe region for the entire organization. This configuration covers the majority of regulatory requirements without any impact on performance. Users notice no difference in their daily use.

Combine data regions with enabling 2FA, configuring external sharing policies and implementing a data retention policy for a complete security posture.

LCMH, a Google Workspace reseller in Alsace, configures data regions and security settings for SMBs.

For more on security, read our article on data protection in Google Workspace.

Sources

1. Google, Data Regions for Google Workspace. support.google.com/a/answer/7630496
2. Google, Google Cloud Data Residency. cloud.google.com/terms/data-residency
3. Google, Transparency Report. transparencyreport.google.com