Data residency

Keeping data physically inside a specific country or region.

A company might promise that customer data stays on servers in the European Union, or in a single country, and never moves elsewhere.

A contractual and technical guarantee, typically enforced through region-locked cloud infrastructure, that data is stored and processed only within a specified country or region, driven by data localization laws rather than general privacy rules. Region-locked means the systems are configured so data cannot leave the chosen region.

Several related terms are easy to confuse:

• Data residency is where data is stored and processed.
• Data localization is a legal requirement that certain data stay within a country.
• Data sovereignty is the idea that data is subject to the laws of the country where it is stored.

Providers typically meet residency needs in a few ways:

1. They offer a choice of regions, such as a US, EU, or Latin America region.
2. They keep storage, processing, and backups within the chosen region.
3. They commit to this in contracts and document it for audits.

The rules differ by place. Some countries require certain categories of data to stay in-country, for example China and Russia, while the EU's GDPR does not require data to stay in the EU but restricts transfers to countries without adequate protection unless safeguards apply.

Data residency sits next to terms that are easy to mix up:

• GDPR is the EU's privacy law, which governs transfers instead of requiring all data to stay in place.
• SOC 2 is an audit report on a vendor's controls, which may cover how data is handled.
• Data minimization reduces how much data exists at all, which complements keeping it in one place.

For more, see the Privacy Hub.