Why everyone is suddenly asking
The question used to come up only in the public sector. Now it appears in supplier questionnaires from law firms, accountancies and healthcare providers, in cyber insurance proposals, and in client contracts that pass their own data obligations down to you. Email holds more personal data than almost any other system a small business runs, so it is usually the first system they ask about.
What UK GDPR actually requires
It is worth starting with what the law does not say, because it is widely misunderstood. UK GDPR does not require personal data to be stored in the UK. It requires that any transfer of personal data outside the UK rests on a lawful mechanism — such as UK adequacy regulations for the destination country, or appropriate safeguards like the International Data Transfer Agreement.
For the United States, the UK–US “data bridge” has applied since 12 October 2023, allowing transfers to US organisations certified under it. So a provider storing your email abroad is not automatically breaking the law.
The reason UK residency still matters is that it is simpler and more certain: no transfer to assess, no reliance on an arrangement that could be challenged, and an easy answer for the client or insurer asking. Many contracts and frameworks now require it outright, whatever the law permits.
Your email lives in more than one place
When a provider says “your data is stored in the UK”, ask which of these they mean:
- The primary copy — the mailbox database your Outlook connects to.
- Replicas — copies kept for resilience, sometimes in a different region or country.
- Backups — often held by a separate service, and occasionally in a separate country.
- Mail in transit and in filtering — inbound email usually passes through an anti-spam service before it reaches your mailbox.
- Support access — who can see your data when something goes wrong, and from where.
A service can truthfully say its primary storage is in the UK while its spam filtering, backups or support desk are elsewhere. None of that is necessarily wrong, but you need to know it to answer a questionnaire accurately.
Sub-processors: the part people miss
Almost every email service relies on other companies — for filtering, archiving, backups, monitoring or support tooling. Under UK GDPR they are sub-processors, and your provider should be able to give you a current list with the country each one operates in. If they cannot, that is itself an answer.
Where Microsoft 365 stores your email
To be fair to the market leader: for organisations whose Microsoft 365 tenant is set up in the UK, Microsoft stores core customer data — including Exchange Online mailbox content at rest — in its UK datacentres, and it sells an Advanced Data Residency add-on that extends those commitments. For many businesses that is entirely sufficient.
The points customers raise are different ones. Microsoft 365 is a global service, so support and service operations are not confined to the UK. And Microsoft is a US company, which means the US CLOUD Act — which allows US authorities to require US providers to produce data under their control regardless of where it is stored — is part of the picture. How much weight to give that is a judgement for each organisation; what matters is that you can answer the question when asked.
Eight questions to ask any email provider
- In which country is the primary copy of our mailboxes stored?
- Where are replicas and disaster-recovery copies held?
- Where are backups held, and by whom?
- Which sub-processors handle our mail — filtering, archiving, backups — and in which countries?
- From where can your staff access our data, and how is that access controlled and logged?
- Which country’s law is your company subject to?
- Is all of this written into your contract or data processing agreement, or only on your website?
- When we leave, how is our data returned, and how is its deletion confirmed — including from backups?
The seventh question is the important one. A residency claim on a website can change without notice; one in a signed data processing agreement cannot.
How we answer them
MyExchangeServer is run by E-Consulting Ltd, a UK company based in Birmingham. Mailbox databases, their replicas and their backups are held in UK data centres, support is delivered by our own staff in the UK, and those commitments are written into the data processing agreement we provide as standard — along with our sub-processor list. Our security and compliance page sets out the detail, and we will send the documents for an assessment without a sales call first.