# What is Data Residency?

Also called Data Localization, Regional Data Storage.

Data residency refers to the geographic location where data is stored and processed. It is distinct from data sovereignty, which concerns which country's laws govern the data, and from data localization, which is a legal requirement to keep certain data within national borders. Buyers frequently ask about residency because location shapes both legal exposure and access risk.

The three terms are often used interchangeably and should not be. Residency is a factual question about where bytes sit. Sovereignty is a legal question about which authorities can compel access, which can extend to data held abroad by a company subject to that jurisdiction. Localization is a mandate, imposed by particular countries on particular data categories, most commonly financial, health, and government records.

European data protection law does not require that personal data stay in Europe. It regulates transfers to countries outside the European Economic Area, permitting them where an adequacy decision applies, or under safeguards such as standard contractual clauses or binding corporate rules, generally accompanied by an assessment of the destination country's legal environment. Regional hosting is one way to reduce transfer complexity, not a legal requirement in itself.

AI systems make residency harder to characterize accurately, because a request may touch several services in sequence. The application, the database, the object store, the vector index, the model provider, the logging pipeline, and any evaluation or monitoring tool can each sit in a different region. A regional claim is only true if it holds for the entire chain, including subprocessors.

The practical artifacts are a data flow map and a subprocessor list. The map records where each category of data comes to rest and which components it passes through. The subprocessor list names every third party involved and the regions they operate in, and is typically referenced in the data processing agreement so customers can be notified when it changes.

## Key points

- Residency, sovereignty, and localization are three different things
- GDPR regulates transfers, it does not mandate EU-only storage
- A regional claim must hold for every component in the chain
- Model providers, logs, and monitoring tools are easily overlooked
- Document with a data flow map and a subprocessor list

## In practice

A vendor states that customer data is hosted in Europe. Its application servers, database, and object storage are in a European region, but its error monitoring service and one analytics tool route through infrastructure elsewhere, and the model provider serves inference from a different region under a separate agreement. The residency claim is accurate for primary storage and incomplete for the processing chain until those paths are documented.

## Related terms

- [GDPR](/en/glossary/gdpr)
- [Data Processing Agreement](/en/glossary/data-processing-agreement)
- [Data Leakage Prevention](/en/glossary/data-leakage-prevention)
- [Tenant Isolation](/en/glossary/tenant-isolation)
- [AI Governance](/en/glossary/ai-governance)

[Back to the AI Glossary](/en/glossary)