A European-owned cloud can be relevant to an NHS organisation's requirements without automatically resolving its information-governance assessment. The organisation still needs to know what information is processed, which entities receive it and how the proposed service fits its clinical use.
This is particularly important for GP partners and clinical leads who may be shown a hosting location as though it answers the entire privacy question. It does not. A server's address, the cloud operator's ownership and the legality of each information flow are related but different matters.
This guide reflects UK data-protection sources checked on 19 October 2026. The examples are fictional procurement scenarios, not legal determinations about Tandem, Scaleway or an individual practice.
Identify the organisations before tracing the countries
Start with the healthcare provider commissioning the service and identify the organisation supplying the application. Then identify the cloud operator, model-service providers and any other organisations processing relevant information.
The roles depend on what each organisation actually does. The ICO's controller and processor guidance is the appropriate starting point for distinguishing decisions about the purposes and means of processing from processing on another organisation's behalf.
A subcontractor's involvement does not automatically make a service unsuitable. It does make the relationship part of the assessment. The purchaser needs to know which obligations apply through the chain and where responsibility for an instruction or transfer sits.
Do not assume that the brand on the clinician's screen is the only relevant legal entity.
Draw separate lines for storage, processing and access
A practical diagram should follow each information category. For an ambient workflow, that may include live audio, a transcript, the request sent for note generation, the resulting text and the material retained for support or system operation.
Ask where each stage occurs. Then ask who can access it. A support engineer's access may be relevant even when no permanent duplicate database is created.
Backups also deserve a distinct line. So do exports, user-downloaded documents and support attachments. The main application database is only one part of the information environment.
The diagram should be proportionate: it does not need to reveal every internal engineering detail to identify the material recipients, purposes and locations. It does need enough specificity to support an informed assessment rather than a guess.
Apply the restricted-transfer test correctly
The ICO's January 2026 guide describes three questions: does UK GDPR apply to the processing, is the organisation initiating a transfer outside the UK, and is the recipient a separate legal entity? Making information accessible can count alongside sending it.
This is why "the database stays in Britain" is not a complete answer. It is also why every employee accessing a system while abroad should not automatically be described as an identical restricted transfer: the legal relationship and the actual arrangement matter.
Where the rules apply, a transfer needs an applicable mechanism, such as UK adequacy regulations, appropriate safeguards or a relevant exception. Transfer compliance remains only part of the wider data-protection assessment.
The task for the clinical lead is to ensure the questions are answered by the appropriate governance team, not to improvise international-transfer conclusions from a cloud brochure.
Adequacy does not mean no further diligence
When a destination is covered by applicable UK adequacy regulations, that can provide the transfer mechanism without the additional transfer safeguard otherwise required. The buyer still needs to establish the processor's obligations, security, purpose and permitted handling of the information.
Where adequacy does not apply, the organisation should examine the available safeguards and any required transfer risk assessment with competent advice. An exception should not become a casual substitute for designing a sustainable routine processing arrangement.
A service may also involve more than one destination. The position of an initial recipient does not settle every later onward transfer or support arrangement.
The useful record identifies the actual route and mechanism. "GDPR compliant" without that supporting account is a conclusion the purchaser cannot meaningfully inspect.
A fictional practice tests the proposal
Imagine a UK practice evaluating a documentation service whose main application and model processing are described as European-hosted. The practice asks for a list of processors and discovers that troubleshooting may involve a separate support organisation.
The practice should not jump to either conclusion: that all use is prohibited, or that the main hosting claim makes the support access irrelevant. It needs to determine whether identifiable material is accessible, which entity accesses it, where that entity is located and how the arrangement is governed.
The supplier might demonstrate that support uses synthetic examples by default and that access to customer content requires a separately authorised process. Alternatively, it might describe routine access covered by specified terms. Those are different proposals to assess.
The procurement exercise has become useful because a broad assurance has been converted into a concrete information-handling question. No accusation of wrongdoing is necessary.
Build an approval record that follows the use case
The practice should record the clinical task, the approved product configuration and the information needed for that task. It should also identify who reviews generated outputs and how patients are informed.
NHS England's ambient-scribing guidance for information-governance professionals provides a relevant route for individual-care scribing. Its scope should not be stretched automatically to every research, teaching or agentic use involving the same platform.
The approval should state which functions are excluded. A later proposal to reuse consultation content for evaluation or to enable a new external model deserves assessment against its own purpose and information flows.
A broad approval that cannot identify the settings in use becomes difficult to rely upon when something changes.
Security controls need operational meaning
Encryption matters, but the organisation should understand who controls the keys and who can authorise access. A statement that keys are managed by the supplier is different from customer-held keys that the supplier cannot independently use.
Similarly, a claim of role-based access should lead to a demonstration: what can a clinician, administrator and support user actually see? What happens when an account is disabled or a locum leaves?
Logs should help investigate consequential access without becoming an unnecessary duplicate clinical database. The design must balance traceability with minimisation rather than maximising retention simply because storage is available.
These are suggested assessment questions, not a claim that a particular provider lacks the controls.
European infrastructure does not select the right guideline
A legally and technically acceptable service can still produce an inappropriate clinical output. A model running on a European cloud may use a recommendation that does not fit the patient's setting, or misinterpret the information it receives.
Clinical suitability therefore remains a separate part of local assurance. Representative examples should test language, source relevance, workflow and human review alongside information handling.
The European localisation article explains why the local evidence and care pathway are distinct from the location of computation.
A useful closing question for the supplier meeting
Ask the supplier to describe one consultation from capture to deletion or retention, naming the material processors and showing where the final approved record sits. Then ask what changes when support is needed, an optional feature is enabled or the organisation leaves.
A satisfactory answer may be supported by a diagram, contract schedule and demonstration rather than one document. The important point is that the pieces agree.
European-owned infrastructure can be part of a well-governed clinical service. Its value becomes clearer when the buyer knows exactly which requirement it addresses and which responsibilities remain with the healthcare organisation.
Frequently asked questions
Does European hosting remove UK international-transfer questions?
No. The relevant organisations, information flows and access arrangements still need assessment under the applicable UK rules.
Is overseas access always the same as moving the database overseas?
No. They are different technical events, but making personal information accessible to a separate overseas organisation can still constitute a restricted transfer.
Can a GP partner approve a tool solely from a supplier's security badge?
That would be insufficient. Approval should address the particular purpose, configuration, processing arrangements and local clinical workflow with appropriate governance support.