Customer data glossary

Data residency

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Data residency is the physical or geographic location where data is stored and processed, and by extension any rule requiring it to stay within a country or region.

Part of the Learn hub and the customer data glossary.

What it means in practice

Residency is about where data sits: the country or region of the servers that store and process it. A residency policy may be a company choice, a customer demand or a legal rule. When it is a legal mandate, the sharper term is data localisation.

Residency is not control. Data in an EU region run by a non-EU provider is resident in the EU, but the provider's staff may still reach it and its home country's law may still apply, which is the subject of data sovereignty. GDPR itself does not require EU storage; it regulates transfers of personal data to third countries (Article 44 and the articles that follow) 1.

Residency covers more than the primary database. Backups, logs, analytics copies, support access and the location of AI inference all count, and a platform that keeps profiles in-region but sends events to a foreign analytics service has not solved the problem.

The rules differ by country and sector, so maintain a list of obligations per market. The linked tracker and article collect them, with their sources.

Example (European bank): a bank keeps customer profiles in an EU region and checks that backups, monitoring logs and vendor support access stay in the region. It documents the check, because "the database is in the EU" is not the same as "all copies are".

Data sovereignty: whose law and whose control.
Data localisation: residency as a legal mandate.
Data egress: data leaving the region.
Self-hosted customer data platform (CDP): puts location in your hands.
Bring your own cloud (BYOC): your region, vendor-managed.

Where it matters

Data residency requirements by country: rules and sources by jurisdiction.
Player data residency by jurisdiction: licensed operators.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Does GDPR require data to stay in the EU?

No. GDPR does not require EU storage. It restricts transfers to third countries unless a Chapter V mechanism applies (Article 44 onwards).

Is data residency the same as data sovereignty?

No. Residency is where data is stored; sovereignty is whose law applies and who controls access. In-region hosting by a foreign provider gives residency without full sovereignty.

Does in-region hosting guarantee compliance?

No. Compliance also depends on access, sub-processors, backups, logs and the wording of the specific rule.

Sources

Regulation (EU) 2016/679 (GDPR), Article 44 Open source

This entry is general information, not legal advice.