GDPR does not require your SMTP server to be in the EU. It requires that personal data leaving the EU or EEA has a legal basis under Chapter V (an adequacy decision, standard contractual clauses or binding corporate rules) and that every provider handling it signs a processor contract. EU hosting is a design choice that takes the transfer question off the table for your sending stack. If you want that, you have three real routes: an EU-only provider such as Scaleway, an EU region at a US provider such as SendGrid's EU subusers, or your own SMTP server on an EU-based VPS. This is a practical guide, not legal advice, so confirm your setup with counsel.
What GDPR actually says about where email data lives
Two parts of the regulation matter for email infrastructure.
| GDPR part | What it requires | What it means for SMTP |
|---|---|---|
| Article 28 | a written contract with each processor | your ESP or host signs a DPA |
| Articles 44 to 46 | a legal basis for transfers outside the EEA | adequacy, SCCs or BCRs for non-EU providers |
| Article 32 | appropriate security | TLS, access control, encrypted backups |
| Article 30 | records of processing | list where every copy of the data sits |
Nothing in that table says "EU servers only". What it does say is that every time contact data crosses the EEA border, you need to be able to point at the rule that allows it. A US-based ESP with US data centres and US subprocessors means several of those crossings.
Inside the EU, no transfer question. Across the border, every hop needs a legal basis
What counts as personal data in email
People think of the address list. The list is only part of it.
| Data | Personal data? | Where it usually sits |
|---|---|---|
| Email addresses and names | yes | ESP contact store, CRM |
| Personalised message content | yes | ESP logs and archives |
| Open and click events | yes, they carry IP and device data | ESP analytics |
| Bounce and complaint logs | yes | ESP and MTA logs |
| Suppression lists | yes | ESP, kept for years |
| Backups of all of the above | yes | often a different region |
The backups row catches people out. A provider can send from an EU IP while storing logs and backups in the US. Ask where each of these sits, not just where the sending IP is.
Is the EU-US Data Privacy Framework enough?
For many senders, yes. The European Commission adopted the EU-US Data Privacy Framework adequacy decision on 10 July 2023, and the EU General Court dismissed the Latombe challenge on 3 September 2025. Transfers to US companies certified under the framework can rely on it.
The reason EU senders still ask for EU hosting is history. The two earlier arrangements, Safe Harbor and Privacy Shield, were both struck down by the EU's top court. A sending stack that sits entirely in the EU does not depend on the third framework surviving, and it makes the records you keep under Article 30 much shorter.
Which SMTP options keep data in the EU?
| Option | Where data sits | Catch |
|---|---|---|
| Scaleway transactional email | France only, per its own data privacy page | transactional focus, not a campaign tool |
| Mailjet | EU data centres in Germany and Belgium | parent company has US subprocessors |
| SendGrid EU regional subuser | EU, if sending only from the EU subuser | Pro plan or higher with a dedicated IP |
| US ESP with DPA and DPF | US, under the framework | relies on the adequacy decision |
| Your own SMTP server on an EU VPS | the country you choose | you own warm-up and hygiene |
SendGrid's EU setup deserves a careful read. Twilio's own EU regional subuser guide says it needs a paid Pro plan or above with a dedicated IP, and its support pages warn that sending from the parent account or a non-EU subuser can move data out of the EU. Residency depends on how you configure it. We cover SendGrid's plans in is SendGrid good for bulk email.
More control usually means more setup. Your own EU server sits top right
How to run your own SMTP server in the EU
Owning the server is the simplest data map you can draw: one machine, one country, your contract with one host.
- Pick the data centre. Germany, France, Finland and the Netherlands all have large VPS hosts. Choose the country your DPA and customers expect.
- Check port 25. Several hosts block outbound port 25 on new accounts until you ask. Confirm before you buy.
- Sign the host's DPA. The host is your processor for the disk and the network.
- Set authentication. SPF, DKIM and DMARC on the sending domain, and a PTR record that matches the HELO name. Our PTR setup guide covers the reverse DNS part.
- Keep tracking and backups local. Host the tracking domain and backups on the same EU server or another EU location.
- Write it down. One line in your Article 30 record: server, country, host, retention.
Six checks and your sending stack stays in one country
GDPR still applies to the list itself
EU hosting answers one question: where the data is. It does not answer whether you may send at all.
| Requirement | Why it matters |
|---|---|
| Lawful basis, usually consent for marketing | hosting cannot fix a list without it |
| Proof of opt-in per contact | regulators ask for it after complaints |
| Unsubscribe in every message | also required by Gmail and Yahoo |
| Retention limits | delete old logs and inactive contacts |
| Access and deletion requests | answer within one month |
Double opt-in makes the proof part easy. See double opt-in vs single opt-in for the trade-off, and our GDPR overview for the wider rules.
What it costs to keep sending in the EU
| Setup | One-time | Monthly |
|---|---|---|
| SendGrid EU subuser | none | Pro plan from $89.95, dedicated IP included |
| Own EU server, Basic plan | $549 setup | about $11 hosting, paid to your EU host |
| Own EU server, Advance plan | $1,199 setup | about $49 hosting |
The own-server rows do not grow with your contact count. A 100,000-contact list costs the same to host as a 10,000-contact one, because you pay for the server and IPs, not per contact.
How BulkEmailSetup helps
We set up the server in the EU location you choose. You buy the VPS, IPs and domains from your own host, in Germany, France, Finland or wherever your DPA points. We install the mail server, configure SPF, DKIM, DMARC and PTR, add bounce handling and a campaign panel, and hand over a warm-up plan. The data stays on a machine you rent, in the country you picked.
| Plan | One-time fee | Emails per day | Dedicated IPs |
|---|---|---|---|
| Basic | $549 | 25,000 | 3 |
| Advance | $1,199 | 200,000 | 15 |
| Custom | $2,997 | 1,000,000 | 60 |
There is no monthly fee to us, no contact limit and a 15-day money-back guarantee. See Basic plan details or compare all pricing.
Frequently asked questions
Does GDPR require EU-hosted email servers?
No. GDPR does not say where servers must be. It says personal data leaving the EU or EEA needs a legal basis under Chapter V, such as an adequacy decision, standard contractual clauses or binding corporate rules, plus a processor contract under Article 28. EU hosting is a choice that removes the transfer question for your sending stack. It is not a legal requirement. Check your own case with counsel.
Which SMTP providers host only in the EU?
Scaleway's transactional email states that email content, logs and backups stay in France. Mailjet states that personal data is stored in EU data centres in Germany and Belgium, though it has some US subprocessors. SendGrid offers EU regional sending on Pro plans and above with a dedicated IP. Your own SMTP server on an EU-based VPS keeps everything in the country you pick.
Is SendGrid GDPR compliant for EU data?
SendGrid can be used in a GDPR-compliant way. Twilio offers a data processing agreement and the EU-US Data Privacy Framework covers certified US companies. For data residency, SendGrid offers EU regional subusers sending through api.eu.sendgrid.com or smtp.eu.sendgrid.net. That needs a Pro plan or higher with a dedicated IP, and Twilio warns that sending from the parent account can move data outside the EU.
How do I run my own SMTP server in the EU?
Rent a VPS or dedicated server in an EU data centre, for example Germany, France, Finland or the Netherlands. Check that the host allows outbound port 25, install the mail server, then set SPF, DKIM, DMARC and PTR. With BulkEmailSetup's Basic plan you buy the VPS in the EU region you choose, and BulkEmailSetup sets up the server, 3 dedicated IPs and the campaign panel for $549 one-time.
What counts as personal data in email sending?
More than the address list. Names and email addresses, the content of personalised messages, open and click tracking events, the recipient IP and device data those events capture, bounce and complaint logs, and suppression lists can all be personal data. Every system that stores any of these, including backups and analytics tools, is part of the GDPR question, not just the SMTP server.
Is the EU-US Data Privacy Framework still valid in 2026?
Yes. The European Commission adopted the adequacy decision on 10 July 2023, and the EU General Court dismissed the Latombe challenge on 3 September 2025, so transfers to certified US companies can rely on it. Further appeals are possible, which is why some EU senders prefer EU hosting so their sending does not depend on the framework surviving.
Does EU hosting make my email marketing GDPR compliant?
No. Hosting only answers where the data sits. You still need a lawful basis for sending, usually consent for marketing, a clear unsubscribe in every message, records of how each contact opted in, a retention policy and a way to handle access and deletion requests. A server in Frankfurt does not fix a list collected without consent.
