DevOps as a Service Brussels Airport District — multi-cloud

Data residency

No general statutory data-localisation requirement beyond GDPR/EEA transfer rules. In practice, EEA- or Belgium-hosting is frequently imposed contractually in public-sector tenders and by financial-sector outsourcing rules, and cybersecurity obligations for cloud and managed service providers sit under the Law of 26 April 2024 transposing NIS2.

What shapes cloud procurement here

Language is a structural procurement constraint rather than a preference: Flemish public tenders run in Dutch, Walloon and many federal ones in French, and bilingual delivery of documentation and support is a common contractual line item even when the engineering conversation happens in English. NIS2 is already in force via the Law of 26 April 2024, with the CCB as single national authority and its CyberFundamentals (CyFun) tiers used as the practical assurance yardstick — buyers increasingly ask for a CyFun level or ISO 27001 mapping alongside the usual security questionnaire. Brussels concentrates EU-institution, NATO-adjacent and federal buyers who bring their own accreditation regimes, while Belgium's in-country hyperscaler footprint is narrower than neighbouring markets: Azure's Brussels-area region and Google's Saint-Ghislain region exist, but AWS has no in-country region in Belgium and serves it from EU regions plus Local Zone capacity, including Local Zones associated with the AWS European Sovereign Cloud.

Sector regulators