Data residency

Data residency concerns the geographic location of data storage or processing. The exact obligation depends on the applicable contract, policy, or law and on the data class involved. A statement that data 'stays in a region' is incomplete unless it covers copies, backups, logs, support access, and processing by other services. Residency is distinct from privacy, security, and sovereignty, although those concerns can overlap in a governance program.

An operational policy identifies the covered data, permitted locations, processing paths, exceptions, and evidence needed to verify compliance. Replication, recovery, analytics, and third-party services should be included when they handle the covered material. Access from another location may matter even when storage remains local, depending on the governing obligation. A vendor's general region label is not sufficient proof of the path a particular record followed.

For a defensible organization, residency determines whether a value and its supporting evidence can be retained, reviewed, or transmitted in a given environment. Provenance must remain inspectable without violating the policy, which may require controlled access rather than broad duplication. Need-to-know access controls who may see the material; retention schedules govern how long it remains. Data residency answers a separate question about the locations in which it exists or is processed.

Residency is a claim about storage and processing, and both are wider than the primary database. Copies appear in backups, logs, caches, search indexes, analytics tools, support systems, email attachments and model-provider services. A prompt sent to a hosted language model is a transfer of whatever it contains, and the provider's processing location and sub-processors matter. Remote access from another country to data stored locally can itself be a transfer under data-protection law, as the EDPB guidance indicates for access from outside the Union.

Make the claim testable. Maintain an inventory of data stores and flows by data category, with the location of each, the party operating it and the legal basis for any cross-border movement. Check it by inspection of configuration and network paths, not by assertion. Include retained evidence: a retained source copy may contain personal data, and its storage location is as relevant as that of the main database. Treat the inventory as a controlled document, versioned and reviewed when systems change.

Ask for the inventory of data stores by category and location. Check backups, logs, caches and indexes. Ask which third parties process the data and where. Ask how access from outside the region is controlled and logged. Test by following one record through the system and listing every place it is stored or processed.