Why does data residency matter for GRC data?

Neither the Swiss FADP nor the GDPR requires personal data to stay in one country. Both regulate disclosure abroad instead. Under Article 16 of the FADP, personal data may go to a country the Federal Council recognises as adequate, which includes the EU and EEA states and, since 15 September 2024, US companies certified under the Swiss-US Data Privacy Framework. Elsewhere you need safeguards such as standard contractual clauses. The GDPR works the same way for transfers out of the EU, and the EU recognises Switzerland as adequate.

• Customers and regulators ask. Banks, insurers, public bodies and their suppliers often have contract or supervisory expectations about where data sits.
• Fewer transfers. Keeping the data in the jurisdiction of the people it concerns removes transfer assessments for that data.
• Clear jurisdiction. The location sets which courts and authorities can order access to the stored data.

Hosting location is not the whole answer. Laws that apply to the provider can reach data wherever it is stored: the US CLOUD Act, for example, lets US authorities require a provider under US jurisdiction to disclose data in its possession, custody or control, even when it is stored abroad. Ask who operates the platform and its sub-processors, under which law, and how access by authorities is handled, as well as where the servers are. A sovereign cloud strategy looks at all of these.

Acuna GRC is built by the Abilene Group, a Swiss company based in Morges, and is ISO 27001 certified. You choose to host your data in Switzerland, the EU or the US. Every change to your data is written to an audit log, and backups capture your whole organisation, which your administrator can download as JSON or as a ZIP with your files and audit logs. See Administration and security.