diff --git a/docs/tutorials/cloudflare.md b/docs/tutorials/cloudflare.md
index c3b6c9832..d7ca5b667 100644
--- a/docs/tutorials/cloudflare.md
+++ b/docs/tutorials/cloudflare.md
@@ -304,7 +304,7 @@ Using the `external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"` annotati
 
 ## Setting cloudflare-region-key to configure regional services
 
-Using the `external-dns.alpha.kubernetes.io/cloudflare-region-key` annotation on your ingress, you can restrict which data centers can decrypt and serve HTTPS traffic. A list of available options can be seen [here](https://developers.cloudflare.com/data-localization/regional-services/get-started/).
+Using the `external-dns.alpha.kubernetes.io/cloudflare-region-key` annotation on your ingress, you can restrict which data centers can decrypt and serve HTTPS traffic. A list of available options can be seen [here](https://developers.cloudflare.com/data-localization/regional-services/get-started/). Currently, requires SuperAdmin or Admin role.
 
 If not set the value will default to `global`.
 
diff --git a/provider/cloudflare/cloudflare.go b/provider/cloudflare/cloudflare.go
index 6c2591348..e65fc333f 100644
--- a/provider/cloudflare/cloudflare.go
+++ b/provider/cloudflare/cloudflare.go
@@ -431,17 +431,18 @@ func (p *CloudFlareProvider) submitChanges(ctx context.Context, changes []*cloud
 					continue
 				}
 				recordParam := updateDNSRecordParam(*change)
-				regionalHostnameParam := updateDataLocalizationRegionalHostnameParams(*change)
 				recordParam.ID = recordID
 				err := p.Client.UpdateDNSRecord(ctx, resourceContainer, recordParam)
 				if err != nil {
 					failedChange = true
 					log.WithFields(logFields).Errorf("failed to update record: %v", err)
 				}
-				regionalHostnameErr := p.Client.UpdateDataLocalizationRegionalHostname(ctx, resourceContainer, regionalHostnameParam)
-				if regionalHostnameErr != nil {
-					failedChange = true
-					log.WithFields(logFields).Errorf("failed to update record when editing region: %v", regionalHostnameErr)
+				if regionalHostnameParam := updateDataLocalizationRegionalHostnameParams(*change); regionalHostnameParam.RegionKey != "" {
+					regionalHostnameErr := p.Client.UpdateDataLocalizationRegionalHostname(ctx, resourceContainer, regionalHostnameParam)
+					if regionalHostnameErr != nil {
+						failedChange = true
+						log.WithFields(logFields).Errorf("failed to update record when editing region: %v", regionalHostnameErr)
+					}
 				}
 			} else if change.Action == cloudFlareDelete {
 				recordID := p.getRecordID(records, change.ResourceRecord)