Data residency

What it means

Data residency is the physical or geographic location where an organisation's data is stored, such as a data centre in India, Germany or the United States. It is often a choice of region in a cloud account. Customers and laws increasingly ask that certain data stays within a country or a bloc.

The idea that makes it click: the location of the disk is not the whole story. Backups, logs, analytics tools, support systems and AI services can each copy data somewhere else. A promise that data is held in one country can quietly be false because of a tool someone added later.

Why it matters

Residency is now a sales and legal question. Enterprise and government buyers write it into contracts and ask for it in a security questionnaire. Laws can limit transfers: the GDPR restricts moving personal data out of the EU unless safeguards apply, and some sectors in India, including payments, have localisation rules.

Getting it wrong can mean a lost deal, a contract breach or a regulator's question you cannot answer. It also bears on who can compel access. Data held in a given country is subject to that country's law, which some customers need to avoid. See the DPDP Act for the Indian position.

How it shows up

You meet it first as a region setting for databases, storage and compute. Then in the less obvious places: where logs go, where backups replicate, which region a managed service uses, where a support vendor can read tickets, and where an email or monitoring service stores copies.

The usual errors are a replica created in another region for resilience, a third-party tool that ships data to its own servers, and test environments filled with real personal data. Keep an inventory of where each class of data goes, and check it again when a new vendor or feature arrives. Pair it with data classification.