Protecting data is our ongoing commitment to European customers

With AWS, you control your data by using powerful AWS services and tools that allow you to determine where your data is, how it is secured, and who has access to it. Services such as AWS Identity and Access Management (IAM) allow you to securely manage access to AWS services and resources. AWS CloudTrail and Amazon Macie enable compliance, detection, and auditing, while AWS CloudHSM and AWS Key Management Service (KMS) allow you to securely generate and manage encryption keys. AWS Control Tower provides governance and controls for data residency.

You can choose to store your customer data in any one or more of our European Regions, including EU Regions in France, Germany, Ireland, Italy, Spain, and Sweden. You can also choose to store your customer data in our Regions in Switzerland and in the United Kingdom. Both Switzerland and the United Kingdom have current adequacy decisions under GDPR for the transfer of personal data. You can also use AWS services with the confidence that customer data stays in the AWS Region you select. A small number of AWS services involve the transfer of data, for example, to develop and improve those services, where you can opt-out of the transfer, or because transfer is an essential part of the service (such as a content delivery service). We prohibit -- and our systems are designed to prevent -- remote access by AWS personnel to customer data for any purpose, including service maintenance, unless that access is requested by you or unless access is required to prevent fraud and abuse, or to comply with law. We are committed to important EU privacy, portability, and digital sovereignty programmes -- including Cloud Infrastructure Services Providers in Europe (CISPE) Code of Conduct, the European Commission Standard Contractual Clauses (SCC), the SWIPO Infrastructure as a Service (IaaS) Code of Conduct, and GAIA-X.

Our contracts are written in plain, straightforward language and include commitments that go beyond those available from other cloud providers to protect customer data. Our strengthened commitments to you build on our long track record of challenging law enforcement requests. If we receive a law enforcement request for customer data from government bodies, whether inside or outside the European Economic Area (EEA), we commit to challenge requests that are overbroad, or where we have any appropriate grounds to do so, including where the request conflicts with EU law, as described in our supplementary addendum to the AWS GDPR DPA. We also provide a bi-annual Information Request Report describing the types and number of information requests AWS receives from law enforcement.

We are transparent about our commitments to protect our EU customers’ data. Our GDPR Data Processing Addendum, including Standard Contractual Clauses, automatically applies for our customers who are subject to General Data Protection Regulation (GDPR). In addition, our UK GDPR Addendum to the AWS GDPR Data Processing Addendum applies when the UK GDPR applies to your use of the AWS Services to process UK Customer Data (as defined in the AWS UK GDPR Addendum). As part of our continued commitments, we offer Privacy Features of AWS Services resources to help you to determine whether the maintenance and provision of our services to you may involve customer data being transferred outside of the AWS Region in which you chose to store customer data. These resources make it easier for you to comply (and demonstrate compliance) with regulations, including GDPR. They also help you complete your data transfer assessments in accordance with recommendations from the European Data Protection Board (EDPB) on transferring personal data in compliance with “Schrems II”. You can select to use AWS services that only store and process customer data in the EU. Links are available on our GDPR Center.

At AWS, security is our top priority and security in the cloud is a shared responsibility between AWS and our customer. You can improve your ability to meet core security, confidentiality, and compliance requirements with our comprehensive services, whether that's through Amazon GuardDuty or our AWS Nitro System, the underlying platform for our EC2 instances. We've designed the Nitro System to have workload confidentiality and no operator access. With the Nitro System, there’s no mechanism for any system or person to log in to EC2 servers, read the memory of EC2 instances, or access any data stored on instance storage and encrypted EBS volumes. In addition, services such as AWS CloudHSM and AWS Key Management Service allow you to securely generate and manage encryption keys, and AWS Config and AWS CloudTrail deliver monitoring and logging capabilities for compliance and audits.

We comply with internationally recognized standards such as Cloud Computing Compliance Controls Catalog (C5) and Esquema Nacional de Seguridad (ENS). We also achieved certifications including PCI-DSS, Hébergement de Données de Santé (HDS, France), and TISAX (EU Automotive), helping satisfy compliance requirements for regulatory agencies across the EU. Financial services providers, healthcare providers, and governmental agencies are among the customers, who trust us with some of their most sensitive information.