Trust & Compliance / GDPR
GDPR compliance
Data residency, sovereignty and the right to erasure.
GDPR requires organizations to protect EU personal data by design, control where it goes, and honor rights such as erasure. XQ encrypts personal data at the object level with keys held by a local custodian in each jurisdiction, restricts access by geography, and can make data unreadable everywhere — including in backups — when a deletion request arrives.
Built for Organizations processing EU personal data · Data protection officers and privacy teams · Multinationals using U.S. cloud providers
At a glance
RegulationEU GDPR and UK GDPR
KeysHeld by a local custodian in each jurisdiction
ResidencyGeofenced access to approved regions
ErasureRevoke a key and every copy becomes unreadable
Works with AWS · Azure · Google Cloud · On-premises · Microsoft 365 · Gmail · Outlook
Keep personal data in region
Local key custodians and geofencing keep EU data readable only where it is allowed to be.
Answer Schrems II transfer risk
Cloud providers hold ciphertext, not keys — a foreign subpoena to the provider yields nothing readable.
Erase it everywhere
Revoking an object’s key makes every copy unreadable, including copies in cloud backups.
What GDPR requires
The General Data Protection Regulation applies to any organization that processes the personal data of people in the EU, wherever the organization is based. It requires privacy by design and by default, appropriate security for personal data, lawful international transfers, prompt breach notification and honoring data-subject rights. Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher.
Cloud pipelines and SaaS tools make this hard: personal data is copied across regions, providers and backups faster than policies can follow it.
How XQ maps to GDPR
| GDPR requirement | How XQ helps |
|---|---|
| Security of processing (Art. 32) | Object-level encryption — named in Article 32 as an appropriate measure — with access control evaluated each time data is opened. |
| Data protection by design and by default (Art. 25) | Protection is embedded in the data itself and applied automatically, not left to each user or application. |
| International transfers (Chapter V, Schrems II) | Keys are held within the jurisdiction by a local custodian, so providers and foreign authorities cannot read the data without your knowledge and consent. |
| Right to erasure (Art. 17) | Revoke the key for a data subject’s records and every copy — primary storage and backups — becomes unreadable. |
| Breach notification (Arts. 33–34) | Per-object access logs show exactly what was accessed; data that stayed encrypted is unintelligible to an attacker, which Article 34 recognizes when deciding whether individuals must be notified. |
Mapping data residency or erasure for a specific system?
Right to be forgotten in backups
Deleting one person’s records from every cloud backup is slow and often impractical. With XQ, each object is encrypted with its own key, so erasure becomes a key operation: revoke it, and the data is unreadable wherever copies remain — with the revocation recorded in the audit trail as evidence.
Related resources and articles
- NIS2 compliance
- AI Governance solutions
- Trust & Compliance overview
- From Sovereign Trust to Sovereign Data: How XQ Enables Resilient Defense Ecosystems
- Why Data Sovereignty Matters More Than the AI Model — and What It Means for the Enterprise
- XQ Sovereign Data Governance
- From Policy to Practice: Operationalizing Data Sovereignty Through Zero Trust
FAQ
GDPR, answered directly.
How does XQ help with GDPR data residency?
Each object’s keys are held by a custodian inside the approved jurisdiction and access is geofenced, so personal data can only be decrypted in regions you allow — even if the encrypted copy is stored or replicated elsewhere.
Does XQ address Schrems II and the U.S. CLOUD Act?
XQ is designed for that risk: data is encrypted before it reaches the cloud and the keys stay with a local European entity, so a request to the cloud provider cannot produce readable data without your knowledge and consent.
How does XQ support the right to erasure?
Revoking an object’s key makes the data unreadable in every location at once, including backups where deleting individual records is impractical, and the revocation is logged.
How does XQ help with GDPR breach notification?
Per-object access logs show exactly which personal data was accessed, by whom and when, which helps you scope a notification to the supervisory authority. Data that stayed encrypted is unintelligible to an attacker, which Article 34 takes into account when deciding whether affected individuals must be told.
Is encrypted data still personal data under GDPR?
Usually yes, and GDPR still applies — but strong encryption with separately held keys is one of the measures Article 32 names, and it lowers the risk and notification burden if encrypted data is exposed.
Keep EU personal data under your control.
Talk to our team about residency, sovereign key custody and erasure in your environment.