FinOps Berlin Adlershof — multi-cloud

Data residency

There is no general statutory requirement to store data physically in Germany; GDPR permits processing anywhere in the EU/EEA and third-country transfers under Chapter V. In practice, residency pressure comes from public-sector and regulated-industry procurement, where BSI C5 attestation — currently issued under C5:2020; the revised C5:2026 catalogue was published in March 2026 and applies to audit engagements beginning on or after 1 June 2027, with early adoption permitted — and EU/Germany hosting are frequently made contractual conditions. Financial institutions are additionally bound by DORA (applicable since January 2025) and BaFin's supervisory guidance on cloud outsourcing.

What shapes cloud procurement here

Procurement is document-heavy and conducted in German: public bodies contract on the standardised EVB-IT terms, and private enterprises typically expect German-language contracts even when the delivery team works in English. A BSI C5 Type 2 attestation is a routine gate alongside ISO 27001 for anything touching regulated or public-sector workloads, and financial-sector buyers layer DORA register and exit-plan obligations on top. Two structural quirks shape deals: data protection supervision for private companies sits with the 16 Länder authorities rather than the federal BfDI, so the competent regulator depends on the customer's registered seat; and works councils (Betriebsrat) hold co-determination rights over tooling that could monitor employee performance, which regularly slows rollouts of observability, CI and developer-analytics platforms. Frankfurt is the interconnection centre (DE-CIX) and the default landing zone for most hyperscaler workloads.

Sector regulators