Data Residency

Data residency requires an organisation to store specified digital data within a defined geographic area, such as a country or an approved cloud region. It identifies the physical location of the infrastructure holding the data; whether processing or transfer must also remain there depends on the applicable law, policy or contract.

What the requirement covers

Compliance begins by selecting data centres and cloud regions located inside the prescribed territory and determining which categories of data are covered.

• The requirement may extend to primary databases, replicas, archives and backup copies.
• If processing is also restricted, analytics or AI workloads must run on infrastructure within the permitted location.
• Organisations use access controls, location records, contracts and audits to demonstrate compliance.

Related but distinct concepts

Data residency concerns geographic storage, while data sovereignty concerns the legal authority and rules applicable to data. Data localisation usually denotes a legal or regulatory mandate to keep specified data within national borders.

• Residency does not automatically prohibit cross-border transfers unless the governing rule requires exclusive domestic storage or restricts transfer.
• A rule may permit overseas processing while requiring a complete domestic copy, or it may require both storage and processing locally.

Relevance to AI deployment

AI systems may handle prompts, outputs, training or fine-tuning datasets, logs and backups across several cloud services. Organisations must therefore map each AI data flow and choose compliant deployment regions rather than selecting a model solely for performance.

• Residency can influence cloud architecture, vendor selection, latency, cost and disaster-recovery design.
• Sensitive datasets should not be routed to an external model endpoint whose storage location conflicts with the applicable residency requirement.