Data residency
Also called data localisation, data sovereignty.
Where data is physically stored and processed, and the laws or contracts that say where it may and may not go.
Last updated
What it is.
Data residency is about geography: which country or region your databases, backups, logs and processing run in. Some requirements come from law, some from customer contracts, and some from sector regulators.
The GDPR does not, as a rule, require data to stay in the EU. Chapter V instead restricts transfers of personal data to countries outside the EU unless conditions are met, such as an adequacy decision or appropriate safeguards. Other countries have their own laws, and some require certain data to stay in the country.
Why it matters
Residency affects hosting choices, which third-party services you can use, and how you run support and AI features. An LLM API, an error tracker or a support tool can move data to another region without anyone noticing, which can break a contract or a law.
In a product build
Residency is cheapest to decide before the first deploy: picking the hosting region, the AI provider's region and the data path for logs and backups at the start of a build.
Common mistakes.
- 01
Moving the database but forgetting backups, logs and analytics.
- 02
Assuming a provider's region setting covers every feature, including support access and AI processing.
- 03
Treating residency as the same as security. Data in the right country still needs protecting.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data processor (GDPR)Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
- DPA (data processing agreement)The contract the GDPR requires between a data controller and a processor that handles personal data for it.
- Vendor lock-inWhen leaving a supplier, platform or tool would cost so much time or money that you are effectively stuck with it.
- Encryption at restEncrypting stored data, such as databases, files and backups, so it cannot be read without the key.
Guides and pages
Browse the full glossary or read answers to common questions.
