Data Residency

Data residency refers to the physical place where data is kept: the country or region whose data centres hold a company's records and run its processing. An organization may choose a location for reasons of cost, speed or customer preference, or may be obliged to use one by a contract, a regulator or the law. The term is used in procurement and compliance to state where data will reside and to give assurances that it will not move.

For banks, payment companies and their technology suppliers, residency is a routine question in due diligence. A bank buying a cloud-based service asks where customer data will be stored, where backups are held, and from which countries the supplier's staff can reach it. The answers determine which laws apply to the data and which authorities can demand it.

Three terms are often used loosely for the same idea but have distinct meanings.

• Data residency is the fact or commitment that data is stored in a given place. It may be voluntary.
• Data localization is a legal mandate that data must be stored, and sometimes processed, within a country, often with limits on export.
• Data sovereignty is the principle that data is subject to the laws of the country in which it is located, and in some usages to the laws of the country whose people it describes.

A company can meet a residency commitment and still face sovereignty questions. Data held in one country by a subsidiary of a foreign group may be reachable by the authorities of the parent's home country under that country's law, regardless of where the servers are.

Requirements come from several directions. Sector regulators may require that certain records be kept in the country or be accessible there without delay. Privacy laws commonly restrict the transfer of personal data abroad without prescribing local storage. Under the European Union's General Data Protection Regulation, personal data may leave the European Economic Area only to a country judged to offer adequate protection, or under safeguards such as standard contractual clauses. Transfers to the United States were disrupted when the Court of Justice of the European Union struck down the Privacy Shield arrangement in 2020 in the case known as Schrems II; a replacement, the EU-US Data Privacy Framework, was adopted in 2023.

Contracts are an equally important source. Enterprise and public-sector customers frequently insist on in-country or in-region storage as a condition of purchase, whatever the law requires, and financial institutions pass on to their suppliers the commitments they have made to their own regulators.

Large providers of cloud computing divide their infrastructure into regions, and customers select the region in which each resource runs. Meeting a commitment in practice takes more than selecting a region. Backups, disaster recovery sites, logs, analytics copies and support tools all need to stay in bounds, and many breaches of residency arise from these secondary flows.

Access is treated separately from storage. An engineer in another country who can view production data is, in the eyes of many regulators, causing a transfer even if no file moves. Firms therefore restrict administrative access by location, or keep the data encrypted with keys that only an in-country team controls, an application of key management. Tokenization is used in a similar way: sensitive values stay in a local vault, and only tokens travel to central systems. Some software vendors offer separate deployments for each region so that no customer data crosses between them.

Supervisors generally allow regulated firms to use providers abroad but hold the firm responsible for the result. Rules on outsourcing, including European Banking Authority guidelines and the European Union's Digital Operational Resilience Act, which has applied since January 2025, require firms to know where their data and critical services are located, to record this in a register, to secure audit and access rights for themselves and their supervisors, and to plan how they would exit. These duties are part of outsourcing oversight.

Card data has its own considerations. The PCI DSS does not dictate where data is stored, but every location that stores, processes or transmits it falls within the scope of the assessment. Payment platforms that serve several countries often process in regional hubs and must reconcile that design with any national localization rules. Customers and auditors look for evidence of where data is held in documents such as a SOC 2 report.

Keeping data in many separate locations raises infrastructure and staffing costs, complicates global reporting, and can reduce the effectiveness of functions that benefit from a worldwide view, such as fraud and financial crime detection. It can also increase operational risk if a small local site lacks the redundancy of a large one. On the other side, concentrating data in one jurisdiction exposes it to that jurisdiction's legal and political risk. Many firms settle on a regional model, a small number of locations chosen to satisfy the strictest applicable rules, and review it as laws on data privacy and data retention change.