Does Dropbox offer EU data residency?
Dropbox, Inc. · File Storage · official site ↗
EU residency on higher tiersEU-US DPF + SCCsDPA available
Where does Dropbox store EU data — and who can touch it?
Dropbox offers EU data residency only on higher plan tiers, and relies on the EU-US Data Privacy Framework plus SCCs for transfers.
Dropbox offers EU data residency only as a migration for eligible Standard/Advanced/Business/Enterprise teams (10+ licences, by support request), is certified to the EU-US Data Privacy Framework, and publishes a self-serve DPA with SCCs.
EU data residency
Can you keep data in the EU?
Dropbox storage servers are available in the EU (among other regions) for eligible users — those on Dropbox Standard, Advanced, Business, Business Plus or Enterprise with a minimum of 10 licences. Migration to an EU region is provisioned through an individually reviewed support request, not a free-tier self-serve toggle.
Transfer mechanism
Dropbox self-certifies to the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF, and incorporates the EU SCCs into its DPA; EU residency reduces but does not eliminate transfers (support and sub-processor flows can still cross borders).
Sub-processors
Who else processes your data?
Dropbox publishes a public sub-processor list and, per its DPA, informs customers in advance of new sub-processors with a 60-day objection window. The list is the canonical source for current names. current sub-processor list ↗
Data Processing Agreement (DPA)
Does Dropbox sign a DPA?
Dropbox publishes a standard DPA with the model clauses, incorporated into the business agreement and available to team/business customers without bespoke negotiation. DPA ↗
What the trust-badge pages don't tell you
EU residency is real but conditional: it needs a paid team plan, at least 10 licences, and a provisioned migration request — it is not a setting an individual or small free team can flip. Plan for the licence floor.
$249/moto monitor up to 25 vendors' DPA & residency
≈ $3,000/yr, incl. cited bulk export
≈ $3,000/yr, incl. cited bulk export
Monitor your whole vendor list for DPA & residency changes
The free lookup answers one vendor at a time. Teams running EU vendor intake track dozens and need to know the moment a sub-processor, residency region or DPA term changes. Leave your work email and we'll set up monitoring + a cited export for your list.
Get notified when this changes
Compliance isn't one-and-done. Leave your email and we'll alert you when any vendor's BAA or HIPAA status we cover changes.
Frequently asked questions
Does Dropbox offer EU data residency?
Only on higher tiers. Dropbox storage servers are available in the EU (among other regions) for eligible users — those on Dropbox Standard, Advanced, Business, Business Plus or Enterprise with a minimum of 10 licences. Migration to an EU region is provisioned through an individually reviewed support request, not a free-tier self-serve toggle.
Where does Dropbox send my data, and does it rely on SCCs?
Dropbox self-certifies to the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF, and incorporates the EU SCCs into its DPA; EU residency reduces but does not eliminate transfers (support and sub-processor flows can still cross borders).
Who are Dropbox's sub-processors?
Dropbox publishes a public sub-processor list and, per its DPA, informs customers in advance of new sub-processors with a 60-day objection window. The list is the canonical source for current names. See the current list at https://www.dropbox.com/privacy/subprocessor/dropbox.
Does Dropbox sign a GDPR Data Processing Agreement (DPA)?
Yes — Dropbox publishes a standard DPA with the model clauses, incorporated into the business agreement and available to team/business customers without bespoke negotiation.
Is Dropbox GDPR compliant?
Dropbox can be used in a GDPR-compliant way, but compliance depends on your configuration, not just the vendor: Dropbox offers EU data residency only as a migration for eligible Standard/Advanced/Business/Enterprise teams (10+ licences, by support request), is certified to the EU-US Data Privacy Framework, and publishes a self-serve DPA with SCCs. You are the controller — confirm the current DPA, residency and sub-processor terms with Dropbox, Inc. and run a transfer impact assessment before processing EU personal data. This is not legal advice.
Sources
https://help.dropbox.com/security/physical-location-data-storage
https://www.dropbox.com/security/gdpr
https://www.dropbox.com/privacy/subprocessor/dropbox
This page is cited public information, not legal or compliance advice. Whether Dropbox can lawfully process your EU personal data depends on your plan, configured region, contract and a transfer impact assessment you control. Always confirm current terms with Dropbox, Inc. before sending EU personal data.