{"head":{"title":"What Is Data Residency? Definition and Example | OceanLab","description":"Data residency is where data is physically stored and processed, and the rules or contracts that limit it. GDPR transfer rules, an example and mistakes.","canonical":"https://oceanlab.in/glossary/data-residency"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"data residency","path":"/glossary/data-residency"}],"slug":"data-residency","term":"Data residency","aka":["data localisation","data sovereignty"],"category":"Compliance","short":"Where data is physically stored and processed, and the laws or contracts that say where it may and may not go.","body":[["Data residency is about geography: which country or region your databases, backups, logs and processing run in. Some requirements come from law, some from customer contracts, and some from sector regulators."],["The GDPR does not, as a rule, require data to stay in the EU. Chapter V instead restricts transfers of personal data to countries outside the EU unless conditions are met, such as an adequacy decision or appropriate safeguards. Other countries have their own laws, and some require certain data to stay in the country."]],"why":["Residency affects hosting choices, which third-party services you can use, and how you run support and AI features. An LLM API, an error tracker or a support tool can move data to another region without anyone noticing, which can break a contract or a law."],"example":["A European health insurer requires its software vendor to keep all customer data in EU regions. The vendor moves its database and backups to an EU region, picks an EU endpoint for its LLM provider, and lists the location of every sub-processor in its DPA."],"inBuild":["Residency is cheapest to decide before the first deploy: picking the hosting region, the AI provider's region and the data path for logs and backups at the start of a build."],"mistakes":[["Moving the database but forgetting backups, logs and analytics."],["Assuming a provider's region setting covers every feature, including support access and AI processing."],["Treating residency as the same as security. Data in the right country still needs protecting."]],"related":[{"href":"/glossary/data-processor","label":"Data processor (GDPR)","detail":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions."},{"href":"/glossary/dpa","label":"DPA (data processing agreement)","detail":"The contract the GDPR requires between a data controller and a processor that handles personal data for it."},{"href":"/glossary/vendor-lock-in","label":"Vendor lock-in","detail":"When leaving a supplier, platform or tool would cost so much time or money that you are effectively stuck with it."},{"href":"/glossary/encryption-at-rest","label":"Encryption at rest","detail":"Encrypting stored data, such as databases, files and backups, so it cannot be read without the key."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}