What is data residency?
Data residency is the requirement that certain data be kept, and often processed, inside a specified country or region. It may come from a law such as the General Data Protection Regulation (GDPR), a sector regulator, a government procurement rule, or a customer contract stating where its information may live. Cloud providers meet it by offering regions and letting customers pin storage and compute to one.
Residency is a location rule. Data sovereignty is the broader principle of which laws apply and who can be compelled to disclose the data, and vendors often confuse the two.
Why data residency matters
In AI projects, residency is easy to violate by accident. A team pins its database to a domestic region and then wires in a model API, a transcription service, or a vector search product that processes elsewhere. Each prompt and uploaded document is a cross-border transfer, and the integration diagram rarely shows it. The fix is to inventory every service that touches the data and confirm each one’s processing region, including backups, logs, and support tooling.
A county government moving its permit records to the cloud is told by counsel that resident data must stay in the United States. The IT director keeps the records in a domestic region, but the chatbot vendor chosen to answer resident questions processes them abroad. Running an open-weight model in the same region as the records, on infrastructure the county controls, satisfies the rule. Hosted models and managed AI services deserve the same check before contracts are signed.