GDPR doesn't mandate that data should reside only within the borders
of the EU. It actually provides great transfer mechanisms for the free
flow of data to and from countries outside the EU too. Some of these
transfer mechanisms are the Binding Corporate Rules (Article 47),
Privacy Shield and Model Contractual Clauses, among others.
So if you have data in the US Data Center (
zoho.com) and have signed the Data Processing Addendum
(DPA),
your data will be safe. The DPA, which references the EU Model
Contractual Clauses will still help in the transfer of data from non-EU
countries. To get an updated DPA, send an email to
gdpr-compliance@zohocorp.com and clearly mention if you've signed up in
zoho.com or
zoho.eu.
However, if you really need to migrate your data to the EU DC, you can send an email to
security@zohocorp.com mentioning
all the services you are using. This email will be forwarded to the
relevant product teams, who will help you with migration.
Note: Zoho participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework.