GDPR Article 45 requires EU personal data stored in EU or "adequate" jurisdictions. Domain WHOIS data = personal data. Use EU-based registrar or ensure registrar has EU data centers.
WHOIS Data Under GDPR
Domain registrant data (name, address, email, phone) is personal data under GDPR. Registrar is data controller. Must: Store in EU/EEA, obtain consent, allow deletion request, notify breaches within 72 hours.
GDPR compliance impact: Pre-2018 WHOIS was public. Post-GDPR: 91% of EU registrant data redacted from public WHOIS. Registrars face €20M or 4% revenue fines for violations.
EU vs Non-EU Registrars
EU registrar (OVH, Gandi, EuroDNS): Data stored in EU by default. GDPR-compliant infrastructure. Non-EU registrar (GoDaddy, Namecheap): May store data in US. Need Privacy Shield successor or Standard Contractual Clauses.
Adequacy Decisions
GDPR allows data transfer to countries with "adequate" protection: UK, Switzerland, Japan, Canada (commercial). US has Data Privacy Framework (replaced Privacy Shield). Verify registrar participates in DPF.
Data Processing Agreements
If using non-EU registrar, require Data Processing Agreement (DPA). Confirms: Data processing location, security measures, sub-processor list, EU data subject rights. Most major registrars offer standard DPA.
DPA requirement: GDPR Article 28 mandates written agreement with data processors. No DPA = GDPR violation. Fine: Up to €10M or 2% annual revenue. Check registrar terms for DPA clause.
Cookie Consent for Domain Websites
Website on EU domain must comply with ePrivacy Directive (Cookie Law). Requires: Explicit consent before non-essential cookies, ability to reject, cookie policy page. Affects all .eu domains and EU-targeted sites.
Cookie consent enforcement: Average fine €250,000 for violations. Google fined €90M in France (2020), €60M (2022). Cookie consent banner mandatory for EU audience regardless of business location.
.eu Domain Eligibility
Only EU residents, companies registered in EU, or organizations established in EU can register .eu domains. Brexit: UK entities lost .eu domain eligibility. Existing .uk.eu domains transitioned to .eu or deleted.
Domain as Personal Data Asset
Domain registered to individual (not company) = personal data asset under GDPR. Individual has right to: Access their data (WHOIS info), rectify errors, delete domain registration (with notice period).
Right to Erasure Limits
Can't instantly delete domain (would break internet). Registrars implement "right to be forgotten" as: Transfer domain to new owner, or let domain expire after current registration period.
EUIPO Trademark Coordination
Register EU trademark via EUIPO. Protects across all 27 EU member states. Coordinate .eu domain registration with EUIPO filing. Trademark gives legal basis to recover infringing .eu domains via ADR.
EUIPO trademark + .eu domain = complete EU brand protection. Trademark covers legal name rights. Domain covers digital presence. Both needed for robust protection across EU.
Hosting Data Residency
Domain registered in EU but website hosted in US = potential GDPR issue if collecting EU personal data (contact forms, newsletter, cookies). Use EU-based hosting (Hetzner, OVH) or US host with EU data centers.
Schrems II impact: 2020 ruling invalidated Privacy Shield. US hosting more complex now. Requires: Standard Contractual Clauses + additional safeguards + transfer impact assessment. EU hosting simpler.
Multi-Country Domain Strategy
Operating across EU: .eu (pan-European brand) + country TLDs (.de, .fr, .es for local markets). GDPR applies uniformly but local marketing regulations vary. .eu + local ccTLDs = best coverage.
Data Breach Notification
Registrar suffers data breach (WHOIS data exposed) = must notify: Supervisory authority within 72 hours, affected registrants without undue delay. You (registrant) must notify customers if breach affects them.
Brexit Implications
UK left EU. UK GDPR mostly mirrors EU GDPR. But: Separate jurisdictions. .uk domains not affected. .eu domains: UK entities ineligible. Data transfers UK↔EU require adequacy decision (currently in place but subject to review).
Trademark Lens checks .eu and country-code domain availability - secure GDPR-compliant domains with EU-based registrar for full data residency protection.