Daryll Holland

Nicholas - No, they don't physically need to be located in EU territory, they can be outside of the EEA (European Economic Area). However, safeguards need to be in place to transfer data outside of the EEA such as Privacy Shield (which is now not valid), EU standard contractual clauses or consent from the end user. 

Can someone from Zendesk please update us with what progress is being made? The GDPR text has been out in its final form since March 2016 - over four years ago.