Beyond jurisdiction: why EU organisations need accountable domain registrars

US incorporation does not remove EU obligations

A US-based registrar may face obligations under both US and European law. Its place of incorporation does not automatically put it beyond European regulation.

GDPR can apply to providers outside the EU where Article 3’s conditions are met, including relevant processing connected with offering services to individuals in the Union. GDPR Article 3

NIS2 also expressly addresses domain registration providers established outside the Union that offer services within it, including through EU representation and jurisdiction rules in Article 26. NIS2 Article 26

The difficulty is making applicable obligations work across borders. Customers and authorities need usable contact points, clear procedures, and effective routes for escalation.

A provider that relies on a general statement about operating under US law, without explaining how it handles applicable European requirements, leaves a material question unanswered. European customers should require that explanation before entrusting it with critical domains.

Abuse mitigation must have its own process

Consider a hypothetical phishing attack against a European organisation. A criminal registers a lookalike domain and uses it to collect credentials. The organisation reports the full URL, supplies screenshots, and explains the impersonation.

Two separate questions arise: what action should stop the phishing, and under what conditions may the registrant’s personal information be disclosed?

Those questions require different assessments. Restrictions on data disclosure do not, by themselves, settle the registrar’s responsibility to investigate and mitigate abuse.

Since 5 April 2024, ICANN’s amended contractual requirements have required accredited registrars handling covered generic top-level domains to take prompt, appropriate mitigation action when they have actionable evidence of DNS abuse. The defined categories include phishing, malware, botnets, and pharming, as well as spam used to deliver those threats. The obligation is not conditional on first obtaining a US court order. ICANN DNS abuse obligations

Action must fit the circumstances. Suspending a compromised legitimate domain can also disable email and other services. ICANN therefore requires appropriate mitigation and does not impose a universal takedown deadline. ICANN DNS abuse obligations

For buyers, the test is whether the registrar can demonstrate timely investigation, reasoned decisions, and action proportionate to the harm. An automated acknowledgement provides little assurance on its own.

NIS2 strengthens registration-data accountability

Article 28 of NIS2 requires Member States to impose requirements for accurate and complete registration data, verification procedures, and lawful access for legitimate access seekers. It specifies replies to access requests without undue delay and within 72 hours. This is a response requirement; it neither guarantees disclosure nor establishes a universal domain-takedown deadline. NIS2 Directive

The applicable national implementing law and the provider’s activities matter. Registration services, DNS services, and TLD registry operations should not be assumed to carry identical NIS2 obligations. NIS2 Directive

European buyers should ask how their registrar verifies registration information, assesses lawful access requests, and explains refusals. These processes matter when investigating impersonation and other domain-related harm.

The Digital Services Act adds another layer

The Digital Services Act applies to relevant intermediary services offered in the Union regardless of where the provider is established. Article 13 requires EU legal representation for covered providers without an EU establishment. Digital Services Act

The duties depend on the service supplied. Registrars appear among the categories that can qualify as mere conduit services, while Article 16’s notice-and-action requirements apply to hosting services. A business providing both registration and hosting must assess the obligations attached to each activity. Digital Services Act

Buyers should expect their provider to identify its responsibilities clearly and explain which channel handles each type of report or legal request.

Foreign disclosure demands require scrutiny

European organisations must also consider how requests from foreign authorities could affect their own account and registration data.

The European Data Protection Board’s final guidance on GDPR Article 48 explains that a foreign authority’s request does not itself establish a legal basis for processing or a ground for international transfer. Relevant disclosures must satisfy the GDPR’s processing and transfer requirements. EDPB guidance on GDPR Article 48

Customers should ask who reviews conflicting obligations, what safeguards apply, and when notification is possible. The location of a data centre alone cannot answer those questions.

Choose European accountability and verify it

For EU organisations, an EU-established registrar with clear ownership, accessible legal recourse, and effective incident escalation can offer practical advantages. Those advantages must be supported by evidence.

European incorporation alone does not establish good abuse management or eliminate foreign dependencies. Ownership, subcontractors, and the registry behind each top-level domain remain part of the assessment. Moving to an EU registrar does not necessarily change the registry’s jurisdiction.

Before selecting or renewing a registrar, require:

• Clear identification of the contracting entity, ownership, and applicable jurisdictions.
• Relevant EU representatives and working contacts for authorities.
• Documented abuse investigation and urgent escalation procedures.
• Separate procedures for abuse mitigation and disclosure of personal data.
• Registration-data verification and lawful access processes.
• Strong account protection, recovery procedures, and a workable transfer plan.

Our recommendation is to make demonstrable European accountability a central criterion in registrar selection. Where a provider cannot explain its legal responsibilities or show that its abuse processes work, that uncertainty belongs in the organisation’s risk assessment.

A registrar is entrusted with part of an organisation’s digital identity. Its ability to protect that identity, respond to abuse, and support lawful investigations deserves the same scrutiny as any other critical supplier relationship.