they ask in which country our data is stored

Location of cloud storage falls under supply chain security, not under encryption

This question falls under the supply chain security measure from Article 21(2)(d) NIS2: the requirements the undertaking imposes on its own suppliers, including the cloud provider. The storage location is therefore not a question about technology, but about supplier management — what agreements have been made with that supplier, and are they documented. Whoever treats this as a standalone factual question and immediately fills in "yes" without an underlying contract answers the question technically correctly but misses the substantiation the customer actually wants.

The evidence document that goes with this is usually the Data Processing Agreement or the sub-processor list of the cloud provider, which shows the location of the data centres. If you do not have this at hand, then "to be determined" is the correct answer here — not because it needs to remain unknown, but because naming a country without that document is an assumption, not a fact. The same documentation is also relevant for the question whether the enterprise establishes security requirements for its own suppliers: a DPA with a fixed location is often the proof that this requirement has been enforced. Some customers do not actually ask this for the location itself, but to verify whether encryption at rest has been applied — then check whether the question does not actually relate to the policy on cryptography and encryption.

Where that appears in the directive: Article 21(2)(d)

Article 21(2)(d) NIS2 explicitly mentions "the security of the supply chain, including security aspects concerning the relationships between each entity and its direct suppliers or service providers" as one of the ten mandatory measures. A cloud provider is such a direct service provider, and the location of data storage is a security aspect of that relationship. ISO/IEC 27001 Annex A elaborates this further under the control measures for supplier relationships, which explains why customers often ask this together with certification questions — see also or whether the undertaking is ISO 27001-certified. The Cybersecurity Act takes this obligation unchanged from the directive.