Table of contents
What is data residency?
Data residency is the physical, geographic location where data is stored, such as a country or region chosen by an organization or its provider. It describes where every copy sits, including backups and replicas, not which country's laws control access to the data, which is data sovereignty.
How do residency, localization and sovereignty differ?
- Data residency is a fact about location: where the disks holding the data physically sit.
- Data localization is a legal requirement that certain data be stored, and sometimes processed, inside a country.
- Data sovereignty is the question of whose law governs the data and who can compel access to it.
Residency is the easiest of the three to verify and the narrowest. Data can sit in-country and still be reachable by a provider controlled from abroad, and a localization law is met only when every copy, not just the primary, is resident.
Where do copies leave the region?
A residency commitment reliably covers the primary copy. Location drifts through secondary copies, each created by a feature switched on for a different reason.
| Secondary copy | How it leaves the region |
|---|---|
| Backups | A backup job writes to a repository or cloud bucket in another region. |
| Replicas and disaster recovery sites | A second site is chosen for distance, which often means another country. |
| Tiering and archive rules | An age-based rule moves older data to a cheaper storage tier hosted elsewhere. |
| Logs and telemetry | Diagnostic data, which can contain personal data, is shipped to a central service abroad. |
| Caches and search indexes | Delivery or index services copy content to locations nearer to users. |
How is the location of every copy verified?
- List every system that stores the dataset, including backup software, backup targets, monitoring and ticketing tools.
- Record the physical location of each copy and the legal entity operating it.
- Check replication, tiering and archive settings, since these move data without anyone deciding to.
- Repeat after changes. A new analytics tool or a new disaster recovery site reopens the list.
If the list cannot be written, residency cannot be shown. The same mapping applies to a public cloud region and to equipment in the organization's own data centers.
Residency in self-operated and cloud storage
With storage the organization runs itself, residency is a configuration: it picks the sites, where replication goes and where multi-region storage placement rules allow data to travel. With cloud services the same facts sit in region settings and contracts. In both cases the backup layer carries the same location requirement as the primary, and the 3-2-1-1-0 backup rule adds copies that each need a location inside the boundary.
Frequently asked questions
Do backups have to stay in the same country as the primary data?
If the residency or localization requirement covers the dataset, yes, since a backup is a copy of the same data.
Does choosing a cloud region guarantee residency?
It fixes the primary location for the services named in the contract. Telemetry, backups and some managed features may still involve other regions, so each service has to be checked.
Is data residency a legal term?
It is used both ways. In contracts it often means a location commitment. A law that requires in-country storage is called data localization.
Related terms
- Data sovereignty: whose law applies, beyond where data sits.
- Data backup: the copy that most often leaves the region.
- 3-2-1-1-0 backup rule: the extra copies residency has to cover.
- Customer-managed keys: key control that complements location control.
- Data locality: placing data near where it is used.
- Multi-region storage: placing copies across regions.