The word in your contract decides, not the provider's map. Find out whether your clause says "UK", "UK or EEA" or "EU" before you compare providers.
We're a UK company: does an EU-hosted LLM API count as UK data residency, and are we allowed to use it? You ask because a customer's contract or security review names a location, and your team wants to pick an LLM API. This guide separates what the law allows from what your contract promises, then tests three contract wordings against one API.
We are Lyceum, a sovereign European AI inference provider for open-source models. That means a European company that runs open models for you on GPUs in European data centres. Our serverless models run in Paris and Finland. Serverless means you call a model through our API and pay per token, without running servers yourself. Your prompts and outputs are processed, not stored, and never used for training.
Why EU and EEA processing does not include the UK
EU and EEA processing means processing in a fixed list of countries, and the UK is on neither list. The United Kingdom left the European Union on 31 January 2020.
The EEA (European Economic Area) is the EU countries plus Norway, Liechtenstein and Iceland.
So "EU" or "EEA" on a provider's page points to those countries. A data centre in London or Manchester is in neither group.
The UK is a country outside the EU for data protection. The European Commission is the EU's executive. Under Article 45 of the GDPR, the EU's data protection regulation, it decides whether such a country protects personal data well enough. That ruling is called an adequacy decision.
Sending UK personal data to an EU-hosted LLM API
A UK company may send personal data to an LLM API hosted in an EEA country without a separate transfer contract. The rule sits in Schedule 21 of the UK Data Protection Act 2018, the UK law that works alongside the UK GDPR.
In plain words, UK law treats a transfer to any EEA country as approved. The schedule lists "an EEA state" among the places a transfer from the UK may go without extra paperwork. Legally, it is treated as approved under the UK GDPR, the UK's own version of the EU regulation.
In practice, a prompt with customer data can go from your London app to a GPU in Paris or Finland on that footing. You do not need standard contractual clauses for it. Those are template contract terms that the GDPR uses as a safeguard when data leaves its area.
That answers the legal question only. Sector rules and your customers' contracts can still ask for more, so confirm your own case with your legal team.
Sending EU personal data to a UK region
EU personal data may also go to the UK without extra safeguards today. The Commission recognises the United Kingdom as adequate under the GDPR.
An adequacy decision lets personal data flow from the EU, Norway, Liechtenstein and Iceland to that country without any further safeguard. The Commission first made two such decisions for the UK in 2021: one under the GDPR and one for law enforcement data. It renewed both on 19 December 2025.
The renewal has an end date. The legal journal eucrim reports that the decision expires on 27 December 2031 unless it is extended. A periodic review is required at least four years after the decision was adopted.
UK data residency is a contract clause, not a legal default
UK data residency is a promise in a contract about where data is processed. The two rules above only say when a transfer is allowed. They do not tell you where your provider must run.
The location requirement comes from somewhere else: a customer contract, a sector regulator or your own security policy. It usually takes one of three forms:
- UK only: every processing step happens in the UK.
- UK or EEA: the UK, the EU countries, Norway, Liechtenstein or Iceland.
- EU/EEA only: the EU countries plus those three, and not the UK.
The same LLM API gives three different answers to these three wordings. Read the clause before you read any provider's map.
Worked example: three customer clauses, one LLM API
One LLM API can meet some customer clauses and break others, as this hypothetical case shows. A UK software company sends support tickets with personal data to an LLM API to draft replies. It has three customer contracts, each with its own location clause.
| Contract (hypothetical) | Location clause | EU-hosted serverless (Paris, Finland) | UK region |
|---|---|---|---|
| A: a UK bank | Processed in the UK only | Does not meet it | Meets it |
| B: a UK retailer | Processed in the UK or the EEA | Meets it | Meets it |
| C: a German customer | Processed in the EU/EEA only | Meets it | Does not meet it |
EU-hosted serverless meets 2 of the 3 clauses. A UK region also meets 2, but a different pair. No single location meets all three, so the company either runs two setups or renegotiates one clause.
Contract C shows why lawful and contracted differ. Sending its data to a UK region would be a lawful transfer under the UK adequacy decision. It would still break the clause the German customer signed.
Time matters too. Now suppose the German customer agrees to change contract C so that a UK region is allowed. The company then sends that customer's data to the UK, which the EU's adequacy decision permits. The table checks two contract lengths against the 27 December 2031 expiry.
| Contract length (hypothetical) | Starts | Ends | Against the expiry |
|---|---|---|---|
| 3 years | 1 November 2026 | 1 November 2029 | Ends before it |
| 6 years | 1 November 2026 | 1 November 2032 | Runs 11 months past it |
The 6-year contract outlives the decision. If the EU does not extend it, the transfer needs another legal basis. So write a backup clause into the contract now: standard contractual clauses take over if the decision ends.
The example does not cover sector rules for banking, health or the public sector. It also leaves out where a provider's own suppliers process data, and it is no substitute for a legal review.
How to check where each model runs before you send data
Check the model page before any personal data goes out. Our model pages state a processing region. The GLM-5.3 page, for example, lists its processing region as "EU-hosted" and tells you to check the region before sending data. The full list is on our models page.
Our serverless models run in Paris and Finland, and our GPUs run in European data centres. A dedicated endpoint (a model on GPUs reserved for you) or a GPU virtual machine runs in a location agreed per contract. If you need a specific EU location, tell us.
Some companies run parts of our service for us, such as GPU capacity or payments; these are our subprocessors. On our legal page, we say they process data mainly in the EU and EEA. Any processing outside the EU and EEA is covered by the GDPR's safeguards, such as standard contractual clauses. The list is available on request. Our guide to subprocessors in the DPA explains what to ask for.
Under our DPA (data processing agreement), you are the controller, who decides why data is processed, and we are the processor. The DPA is Annex 1 of our terms, so it applies when you accept them.
For more on locations, read our data residency guide for LLM APIs and our model-by-model data residency overview.
The decision comes down to your clause. If it allows the EEA or the EU, you can start on our serverless API today. If it demands the UK only, our serverless models do not meet it. To check a deployment against your location clause, talk to our engineers.
Frequently asked questions
What happens to EU-to-UK transfers if the adequacy decision is not extended?
Without an adequacy decision, the EU sender needs another safeguard under the GDPR, such as standard contractual clauses. The current UK decision runs to 27 December 2031 unless it is extended.
Can I object if a provider adds a new company that processes my data?
With us, yes. We tell you before we add or replace a subprocessor, and you can object within 10 business days of our notice.
Does UK law treat Norway and Iceland like EU countries for transfers?
Yes. The Data Protection Act 2018 lists any EEA state, and Norway, Liechtenstein and Iceland are EEA states alongside the EU countries.