What is a Data Residency?

This comes up most often for regulatory reasons - a company operating in the EU may need customer data to stay within the EEA to simplify GDPR transfer obligations, or a healthcare or government customer may require data to never leave a specific country's borders at all. It's a stronger and more literal requirement than encryption or access control: it's about where the bytes physically sit, not just who can read them. Data residency is closely tied to but distinct from data sovereignty, which is about which country's laws govern the data regardless of where it's stored - a distinction that matters because a cloud provider's regional data center doesn't automatically shield data from the legal reach of the provider's home country. Meeting a residency requirement usually means choosing region-pinned cloud infrastructure and ensuring every downstream vendor and backup process also respects that boundary - a single subprocessor or backup job replicating data to another region can silently violate a residency commitment.