Digital: domains, online accounts, data location and provider rules

What this flag means

The digital flag covers the online parts of a cross-border life: domain names and the registrars that manage them, payment and fintech accounts, where your personal data is stored and which privacy law protects it, how you move accounts and data when you move, and the legal checks providers must run. In flag theory it is often presented as a way to be independent of any one country. In practice every provider is itself bound by the law of the places where it is established and does business.

Read this hub knowing FlagSage has no vendor affiliations

FlagSage has no vendor affiliations. It earns nothing from any provider named or unnamed on this site, has no referral or affiliate links and does not recommend providers. Where this hub names an organization, it is a regulator, a law or an official source.

This hub explains how the rules work. It does not show ways around residence, identity, banking, sanctions or provider rules, and it will not.

Know who controls your domain and what you owe the registrar

A domain name is registered through a registrar under a registration agreement. For generic top-level domains, ICANN's registrant benefits and responsibilities page says your registration must be governed by an agreement with an ICANN-accredited registrar, and that you are entitled to clear information about the registrar, its terms, pricing and how it handles registration, transfers and renewals.

The same page lists your duties: give accurate registration data, update it promptly when it changes, follow the registrar's terms and applicable policies, and respond to registrar inquiries. If you move country, your contact data changes too. Out-of-date data is a breach of your own responsibilities, not a privacy feature.

ICANN's Transfer Policy covers moving a domain between registrars and changes of registrant, including periods when a transfer may be locked or denied. ICANN published an updated version in 2024, so check the current policy text before planning a move. Country-code domains are run by their own registries under their own rules, which may differ.

Expect payment and fintech providers to decide access by your legal residence

Banks, payment institutions and fintech apps are licensed for particular countries and must identify their customers under anti-money laundering law. Your country of legal residence affects which products a provider may offer you, which documents it asks for and whether it can keep your account open after you move.

EU law shows how residence is built in. Article 16(2) of the Payment Accounts Directive (2014/92/EU) gives consumers legally resident in the Union a right to a payment account with basic features, including consumers with no fixed address and asylum seekers. Article 16(4) says an application must be refused where opening the account would breach anti-money laundering or counter-terrorist financing rules.

When you change residence, tell your providers as their terms require. A provider may then review, restrict or close an account if it cannot serve customers in your new country. Plan for that before you move. The banking hub covers this in more depth.

Separate where your data is stored from which privacy law protects it

Data can be stored in one country by a provider established in another, about a person living in a third. Privacy law can attach to each of these.

The EU General Data Protection Regulation (Regulation (EU) 2016/679) applies under Article 3(1) to processing in the context of an establishment of a controller or processor in the Union, wherever the processing takes place. Under Article 3(2), it also reaches controllers and processors outside the Union when they offer goods or services to people in the Union or monitor their behavior there.

Article 44 sets the general principle that personal data may be transferred to a third country only if the conditions in Chapter V are met. Providers publish where they store and transfer data in their privacy notices. Read those notices for the accounts that matter most to you.

Plan how you would move your accounts and data

Moving country can cut you off from accounts tied to a phone number, a local ID, a local bank or a local address. Portability is about having the data and access you need to move on your own terms.

Under Article 20(1) of the GDPR, where processing is based on consent or a contract and carried out by automated means, you have the right to receive personal data you provided in a structured, commonly used and machine-readable format and to transmit it to another controller. The EU Payment Accounts Directive separately requires account switching services between providers within a member state for accounts in the same currency.

• Export data from key services before you change phone numbers or close accounts
• Keep two-factor recovery codes somewhere that does not depend on a local SIM card
• List which accounts use a phone number, address or ID from one country
• Check your registrar account email, payment method and renewal settings
• Keep copies of identity and residence documents providers may ask for again

Understand that providers must screen for sanctions

Sanctions are legal restrictions that providers must follow. They are not policies a provider can waive for a good customer.

OFAC says all US persons must comply with OFAC sanctions, which covers US citizens and permanent residents wherever located, anyone in the United States, and US-incorporated entities and their foreign branches. Some programs also cover foreign subsidiaries owned or controlled by US persons, and non-US persons may not cause US persons to violate sanctions. OFAC publishes the Specially Designated Nationals (SDN) List through its Sanctions List Service.

The European Commission says EU sanctions apply within EU jurisdiction and bind EU nationals or people located in the EU or doing business there. The EU Sanctions Map gives details of all EU sanctions regimes, and the Commission maintains a consolidated list of people and entities subject to EU financial sanctions.

Screening can delay a payment, freeze an account or block a sign-up. If that happens, the provider's own complaints process and a qualified lawyer are the routes to take. FlagSage does not explain how to avoid screening.

Do not confuse a VPN, a virtual address or a digital ID with legal residence

Tax residence and immigration status turn on legal tests about where you live, your ties and where you physically are. Estonia's Tax and Customs Board, for example, counts days physically present in Estonia. A VPN changes where your internet traffic appears to come from. It does not change where you are, where you live in law, or which rules bind your providers.

A virtual address or mail-forwarding service gives you somewhere to receive post. It is not a home and does not by itself make you resident anywhere. Giving a provider an address or location that is not your real residence can breach its terms and, depending on the law involved, more than its terms.

Digital identity programs are also not residence. Estonia's e-Residency program says e-Residency is a digital identity, not a change in physical or tax residency, and that it offers no rights of citizenship or residency in Estonia or the EU. See the living base hub for the right to live somewhere and the tax residency hub for tax.

Fictional example: a move that touches every digital account

Fictional example, written on 8 November 2026. Ana lives in Mexico and plans to move to Germany in 2027. She owns a .com domain, runs her freelance invoicing through a payment app opened while she lived in Mexico, stores client files with a cloud provider and uses a Mexican mobile number for two-factor sign-in.

This hub does not tell Ana which providers to use. It shows the questions her move raises. She can list her accounts and countries in the exposure check before she talks to a professional.

• Does the payment app serve residents of Germany, and what will it ask for when she updates her address?
• Which privacy notices say where her client files are stored, and does the GDPR apply to her own processing of client data once she works from Germany?
• What happens to two-factor sign-in if she gives up the Mexican number?
• Is her registrar contact data accurate, and is the renewal payment method one that will keep working?
• Which tax and business registrations does the move raise? See the company and tax residency hubs.

Common misconceptions

Questions to take to a professional

1. Which of my providers can lawfully keep serving me after I change residence, and what must I tell them?
2. Which privacy law applies to my personal data with each key provider, and where is that data stored?
3. If I run a business, which data protection duties apply to the client data I process from my new country?
4. What does my registration agreement require when my contact details or country change?
5. If a payment or account is held for sanctions screening, what are my options under the provider's process and the law?
6. Could any of my business activity involve sanctioned persons, places or goods, and who should review that?
7. Are my contracts with clients or providers governed by a country's law that changes when I move?

Questions people ask

Where this guide stops

Sources

• Registrant Benefits and Responsibilities (ICANN)Official guidance
• Transfer Policy (ICANN)Official guidance
• Regulation (EU) 2016/679 (General Data Protection Regulation)Primary law
• Directive 2014/92/EU on the comparability of fees related to payment accounts, payment account switching and access to payment accounts with basic featuresPrimary law
• OFAC FAQ: Who must comply with OFAC sanctions?Official guidance
• Sanctions List Service | Office of Foreign Assets ControlOfficial guidance
• Overview of sanctions and related resources - Finance - European CommissionOfficial guidance
• EU Sanctions MapOfficial guidance
• Dos and don'ts of e-ResidencyOfficial guidance
• Determining residency (Estonian Tax and Customs Board)Official guidance