An edge data center can host applications that require low-latency access to nearby end devices. If the resource requirements of the applications exceed the capacity of the edge data center, some non-latency-critical application components may be offloaded to the cloud. Such offloading may incur financial costs both for the use of cloud resources and for data transfer between the edge data center and the cloud. Moreover, such offloading may violate data protection requirements if components process sensitive data. The operator of the edge data center has to decide which components to keep in the edge data center and which ones to offload to the cloud. In this paper, we formalize this problem and prove that it is strongly NP-hard. We introduce an optimization algorithm that is fast enough to be run online for dynamic and automatic offloading decisions, guarantees that the solution satisfies hard constraints regarding latency, data protection, and capacity, and achieves near-optimal costs. We also show how the algorithm can be extended to handle multiple edge data centers. Experiments show that the cost of the solution found by our algorithm is on average only 2.7% higher than the optimum.