Moving servers to the EU: when it makes sense

Hosting part of the IT infrastructure in the European Union is an option Ukrainian companies consider so as not to depend on the risks of a single site: power outages, connectivity problems, physical threats to the office or server room. But moving is not a goal in itself. It costs money, changes the requirements for the network, licences and contracts, and sometimes has legal consequences.

Below: when a move to the EU makes sense, which models exist, what your lawyer and your engineers should check, and how to migrate without stopping the business.

When a move makes sense — and when it doesn’t

A move makes sense if:

• Critical systems must keep working whatever happens in Ukraine. If a system can only be down for minutes or a few hours and there is no backup site, the EU is a natural candidate for that role.
• Your clients or partners are in the EU. Services hosted closer to users are faster, and some counterparties may require data to be stored in the EU.
• You need a disaster recovery site. Even if the main infrastructure stays in Ukraine, data copies and standby virtual machines in the EU shorten recovery time.
• The business is growing fast. A public cloud lets you add resources without buying hardware.

A move won’t help or is unnecessary if:

• the system is tied to on-site equipment — production lines, a warehouse, tills: without power at the office it won’t work anyway;
• your industry is subject to requirements to store data in Ukraine — then you need a legal opinion first;
• nobody, in-house or contracted, will run the infrastructure abroad: a remote site without monitoring and procedures is a new risk, not protection.

How to identify critical systems, the acceptable downtime (RTO) and the acceptable data loss (RPO) is covered in “Blackouts: how to keep business IT running”.

Three models: what exactly to move

The site can also be chosen in different ways:

• Public cloud. Large providers have regions in the EU: for example, AWS and Microsoft Azure run regions in several EU countries. You pay for what you use.
• Colocation. You place your own hardware in a commercial data centre in the EU and keep full control of it.
• Private cloud on your own or leased hardware. One managed platform with predictable costs — see private clouds.

Legal questions: settle them before the move

This section is not legal advice. Agree decisions on personal and regulated data with your lawyer.

Personal data under Ukrainian law. Article 29 of the Law of Ukraine “On Personal Data Protection” allows personal data to be transferred abroad if the receiving state ensures adequate protection. The law recognises member states of the European Economic Area as ensuring an adequate level of protection.

GDPR. Two points matter for a Ukrainian company:

• If you offer goods or services to people in the EU or monitor their behaviour, the GDPR may apply to you wherever your servers are (Article 3(2) GDPR).
• Simply using a provider in the EU does not make you subject to the GDPR — this is how the European Data Protection Board (EDPB) explains it in Guidelines 3/2018. But a provider processing data in the EU is itself subject to the GDPR as a processor, including the rules on transfers outside the EU (Chapter V). Ukraine is not on the list of countries whose level of protection the European Commission has recognised as adequate, so returning data to Ukraine needs a transfer mechanism — for example, standard contractual clauses (SCCs).

Sector requirements. Financial institutions, critical infrastructure operators and other regulated companies should check their regulator’s requirements before moving — in particular on where data is stored, audits and incident notifications.

Contract with the provider. Check:

• in which countries the data and backups are physically stored;
• the personal data processing terms (Article 28 GDPR);
• the SLA: availability, response time, service credits;
• the exit procedure: how and in what format you get your data back if you change provider.

Technical questions: what your engineers should check

• Latency. Measure latency from the office to the candidate sites before deciding. Accounting systems with a “thick” client and databases accessed from the office are the most sensitive: sometimes it is easier to move a terminal server next to the database as well.
• Links and VPN. The office connects to the EU site through a secure tunnel. Two links with automatic failover on a next-generation firewall (NGFW) are a must — more in network security and NGFW.
• Traffic costs. In public clouds, count outbound traffic, backups and snapshots separately — they can significantly affect the bill.
• Licences. Check whether software licensing terms — in particular for Microsoft server products and virtualisation platforms — allow running on the provider’s hardware.
• Security. Data encryption, key management, multi-factor authentication for administrators, logging. Connect events from the new site to security monitoring from day one — SOC as a Service.
• Backups. An EU site can be the off-site copy in the 3-2-1 rule. But if the main infrastructure moves there, you need one more copy — in another region or with another provider.

Migration plan, step by step

1. Inventory. A list of systems, the dependencies between them, RTO and RPO.
2. Legal review. Personal data, sector requirements, client contracts.
3. Choice of model and site. Options compared by requirements, budget and risks.
4. Pilot. Move a non-critical service: measure latency, costs and how easy it is to operate.
5. Migration plan. Order of moves, maintenance windows and a rollback plan.
6. Move and verify. Migrate to plan, check that everything works, update the documentation.
7. Drills. Regularly test failover to the backup site and restores from backups.

Pre-decision checklist

• A list of systems with RTO and RPO and a view on which ones to move
• A lawyer has confirmed the conditions for transferring personal data and sector requirements
• A model is chosen: DR site, hybrid or full move
• Latency from the office to the candidate sites is measured
• Costs are calculated, including traffic, backups and licences
• The provider contract fixes data location, processing terms, SLA and exit procedure
• Two links from the office and secure tunnels to the site
• The new site is connected to availability and security monitoring
• Backups follow the 3-2-1 rule, taking the new site into account
• A migration plan with a rollback plan and a drill schedule

How Bereg-IT can help

We inventory your systems and the dependencies between them, compare site options against your requirements, budget and risks, and explain the choice. Then comes a migration plan with the order of moves, maintenance windows and a rollback plan, the migration itself and support afterwards. If some systems should stay in a private cloud, we combine it with a public cloud in a hybrid setup. More on cloud solutions and consulting and audit.

The first consultation is free. Send a request and we will assess what is worth moving, and where, for your business.

Sources

1. Law of Ukraine “On Personal Data Protection” of 01.06.2010 No. 2297-VI, Article 29: https://zakon.rada.gov.ua/laws/show/2297-17
2. Regulation (EU) 2016/679 (GDPR), Articles 3 and 28, Chapter V: https://eur-lex.europa.eu/eli/reg/2016/679/oj
3. EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1, adopted 12.11.2019 — section on a processor in the EU and a controller outside the EU: https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en
4. European Commission, Adequacy decisions — countries with an adequate level of data protection: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
5. AWS, Regions and Availability Zones: https://docs.aws.amazon.com/global-infrastructure/latest/regions/aws-regions.html
6. Microsoft, Azure geographies: https://azure.microsoft.com/en-us/explore/global-infrastructure/geographies/