HDS: EEA-only storage and transparency on transfers now apply

The main obligations of French decree no. 2026-209 of 24 March 2026 apply since 27 September 2026. Hosted health data must be stored only in an EU or EEA country. Remote access from a third country remains possible with an adequacy decision or appropriate safeguards (GDPR Articles 45 and 46).

What it means: contracts must list the foreign laws the host or its subcontractors are subject to, the risks and the measures taken. Hosts must publish a map of transfers and access from outside the EEA. Health SaaS vendors should check their own subcontracting chain.

Source: decree no. 2026-209 of 24 March 2026 (Journal officiel, 26 March 2026). Read on the Cyberbits regulatory watch · Book a free 30-min call