If you’re not using Cloudflare Workers or Cloudflare Pages, it won’t be.
Why? If your data is stored in the EU then that’s all you really need. If you are using Workers or Pages, you can set the jurisdiction on Durable Objects which you can use for storing data.
Globally for Workers and Pages.
You can’t restrict where Workers or Pages run, they’re in every colo.
But, if you’re not using Workers or Pages and likely will need to contact the actual host of your website.
This might be the silliest question yet, but how I can see if we are using Cloudflare Workers or Cloudflare Pages? Sorry took this over with no handover, and new to the Cloudflare environment.
If not hosted by Cloudfare, is there any way we can figure out who is hosting it?
If you have nothing in either of those, check https://dash.cloudflare.com/?to=/:account/:zone/dns and you can do a whois on the IP address that your website is pointing to which should give you a general idea. Usually it’ll be registered to the hosting provider, i.e AWS.
There is nothing in GDPR that states that nothing can happen outside the EU. In reality, it is possible (perhaps even probable) that even if you carry out all data processing inside the EU that your activities are not compliant with the European Data Protection Directives.
For all of its activities, Cloudflare relies on their Data Processing Agreement which incorporates the Standard Contractual Clauses to ensure compliance with European and other privacy legislation. They state that they:
believe that our EU customers can use Cloudflare’s services in a manner consistent with GDPR and the Schrems II decision
If you feel you need additional measures (over and above the default), Cloudflare offers a number of additional products, such as the Customer Metadata Boundary.