Data Residency Requirements by Country for Customer Data Platforms (2026)

Few countries require customer data to stay in-country; most regulate how it leaves. Of 21 jurisdictions reviewed for a customer data platform (CDP), four apply general localisation (Russia, China above CAC thresholds, Kazakhstan, Vietnam conditionally), 14 restrict transfers, two rely on accountability, and the United States has no general rule. Sector rules, such as India's payment data and the UAE's health data, add local-storage duties.

For CISOs, DPOs and architects deciding where a CDP's data, keys and support access must sit. Part of the regulation hub. Each row names a primary source and a last-checked date; VERIFY flags mark claims still to be confirmed.

Definitions: data residency, data localisation and transfer restrictions

Vendors and regulators use three terms loosely. They answer different questions, and an architecture can satisfy one without the others.

Data residency is a location question; transfer safeguards and foreign access require a separate assessment. Inventory storage, backups, support access, subprocessors and key custody before deciding whether a region meets your requirements. See residency versus sovereignty.

How to read the tables: general_rule describes the dominant rule for ordinary private-sector customer data.

• localisation: a statute requires in-country storage or processing, or a local copy, for general personal data (even if only above thresholds).
• transfer_restricted: no general in-country requirement; export is allowed on listed conditions.
• residency: no general localisation or transfer condition; accountability and disclosure duties attach to location, and sector or public-sector rules may localise.
• none: no location rule in the general framework.

Confidence applies to the general rule and the transfer mechanism: verified (primary text read or checked facts), secondary (law-firm or regulator summaries), verify (thin or conflicting sources). VERIFY flags inside cells mark individual claims.

Master table: data residency requirements by country

The same rows are published as a machine-readable CSV with the data residency map.

Jurisdiction notes

European Union and EEA: transfers regulated, storage free

GDPR Chapter V conditions transfers outside the EEA on adequacy, appropriate safeguards or a specific derogation. It does not impose a general EEA storage requirement. Local storage alone does not resolve third-country access. EU-Brazil adequacy was adopted on 26 January 2026 (Commission Implementing Decision (EU) 2026/179). GDPR and EU-Brazil entries in verified-facts.md, including errata. EUR-Lex returned a JavaScript challenge in this refresh. Primary source; additional source.

United Kingdom: transfers regulated under UK GDPR

UK international transfers use adequacy regulations, appropriate safeguards or exceptions. The Data (Use and Access) Act transfer changes commenced on 5 February 2026 under SI 2026/82. EU adequacy for the UK was renewed to 27 December 2031 by Commission Decision C(2025) 8771 final. UK commencement and adequacy confirmed in verified-facts.md errata. legislation.gov.uk returned an unsupported XHTML response in this refresh. Primary source; additional source.

United States: no federal rule, one national-security exception

No federal rule fixes where private-sector customer data sits. The DOJ Data Security Program bars or restricts access by China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela, and covered persons, to bulk sensitive data and government-related data. It took effect on 8 April 2025, with due-diligence and audit duties from 6 October 2025 91040. Bulk thresholds include 10,000 US persons for health or financial data and 1,000 for biometric identifiers. HIPAA and GLBA regulate safeguards and contracts, not location 1112; about 23 state laws add contract and assessment duties 41.

Canada: accountability, with Quebec conditions

PIPEDA is accountability-based: the organisation stays responsible for data it passes to a processor and must use contracts to provide comparable protection (clause 4.1.3) 13. Quebec requires an impact assessment, adequate protection and a written agreement before information leaves the province 14. British Columbia repealed its public-sector storage limits 15; Nova Scotia's PIIDPA is due for repeal in 2027 42. Bill C-36 (first reading 15 June 2026), the successor to the lapsed Bill C-27, is not law 16.

Australia: accountability, plus My Health Record localisation

APP 8 requires reasonable steps to ensure an overseas recipient respects the APPs, and section 16C makes the discloser accountable 1719. The My Health Records Act section 77 bars holding or taking My Health Record information outside Australia 18. Automated decision transparency duties start 10 December 2026 20; tranche 2 reform is a proposal.

Singapore: comparable-protection test

The supplied research describes the PDPA section 26 comparable-protection test for overseas transfers. The current statute and regulator page did not yield readable text in this refresh. The precise exceptions and 2021 Regulations Part 3 remain unavailable; do not treat this summary as a verified permission. Singapore Statutes Online and PDPC URLs opened, but readable current text unavailable. Retains the source package general-rule description with this explicit limitation. Primary source; additional source.

Japan: consent or equivalent system

The PPC official laws index links the APPI and warns that English translations are reference material. The supplied research describes Article 28 foreign third-party provision using informed consent, an equivalent recipient system or a designated country. The linked old PDF was unavailable; current Article 28 wording and the reported 2026 amendment commencement were not confirmed. PPC official laws index retrieved; old APPI English PDF unavailable. General summary remains qualified supplied research. Primary source; additional source.

South Korea: listed transfer grounds

The supplied research identifies PIPA Article 28-8 as the overseas-transfer provision. The supplied KLRI URL returned an incomplete law page and the Chambers secondary link was unavailable. Current grounds, the reported 2026 fine increase and commencement have not been established in this refresh. KLRI page insufficient; Chambers URL inaccessible. No current statutory conclusion asserted. Primary source; additional source.

India: negative list, payment data stays

DPDP Act section 16 lets the Government restrict transfers to notified countries and preserves stricter sector laws 24. RBI requires payment-system data to be stored only in India, with the foreign leg also storable abroad 25. Consent managers apply from 13 November 2026 and main duties from 13 May 2027; a proposal to compress the timeline had no notification in sources found 45. See India's DPDP timeline.

China: localisation above thresholds

PIPL Article 40 requires critical information infrastructure operators and processors above CAC thresholds to store personal information collected in China domestically, with a CAC security assessment for export 26. Other exports use the CAC standard contract or certification; certification measures took effect 1 January 2026 46. CAC provisions of March 2024 exempt some exports 27.

Russia: databases must be in Russia

B1 legal commentary reports that Law 23-FZ reworded Article 18(5), effective 1 July 2025, to prohibit recording, storing and related operations on Russian citizens’ personal data using databases outside Russia, with statutory exceptions. B1 says whether a foreign copy may remain is uncertain. B1 commentary retrieved, dated 6 March 2025; Kremlin statute URL unavailable. This is attributed commentary, not a retrieved consolidated statute. Primary source; additional source.

Turkey: adequacy, safeguards or standard contract

The KVKK official English text shows Article 9 amended by Law 7499. Transfers can use an adequacy decision with an Article 5 or 6 condition; where adequacy is absent, the provision provides appropriate-safeguard and limited incidental routes. Standard contracts must be notified within five working days. KVKK official amended Article 9 and transitional provisions retrieved. Special-category and banking-sector requirements are outside this general-rule review. Primary source; additional source.

Saudi Arabia: transfers allowed, storage mandate proposed

PDPL Article 29 permits transfers for listed purposes if national security is not harmed, protection is adequate and data is minimised 30. Fully enforceable since 14 September 2024 49. SDAIA's consultation, 6 October to 5 November 2026, proposes requiring controllers to store personal data in the Kingdom 50. See Saudi PDPL and customer data.

United Arab Emirates: health data stays

Federal, free-zone and sector rules must be assessed separately. DLA Piper’s January 2025 guide reported unpublished federal Executive Regulations; their current issuance status is unavailable. The UAE government page did not return readable content in this refresh. DLA Piper dated research in verified-facts.md; UAE portal unreadable. Al Tamimi health-transfer analysis retrieved. Primary source; additional source.

Brazil: standard clauses, betting data local

LGPD Article 33 provides grounds for international transfers, including adequate protection and safeguards. The general LGPD transfer regime is distinct from any betting-operator or financial-sector hosting rule. EU-Brazil adequacy was adopted on 26 January 2026 (supplied verified-facts.md). Brazil Presidency consolidated LGPD retrieved; Article 33. Sector claims removed from the general conclusion until their specific instruments are reviewed. Primary source; additional source.

Switzerland: adequacy list or safeguards

The FDPIC explains that foreign disclosure requires adequate protection or an Article 16 safeguard; Article 17 provides specific exceptions. This is a transfer assessment, not a universal Swiss storage mandate. Banking and other sector duties need a separate review. FDPIC official cross-border-transfer guidance retrieved; original Fedlex URL was a JavaScript shell. Primary source; additional source.

South Africa: adequate protection or consent

POPIA section 72 bars transfers to a foreign third party unless it is bound by law, binding corporate rules or an agreement giving substantially similar protection, or consent or contract exceptions apply 35. No localisation.

Indonesia: new transfer rules from January 2027

Hogan Lovells Cadwalader reports GR 33/2026, promulgated on 16 July 2026 and effective on 16 January 2027, with cross-border provisions in Articles 160-174. The supplied research also identifies public-scope localisation under GR 71/2019. The official BPK link is a database home page, not the instrument text; the reported 2026 number/date remain secondary. Hogan Lovells Cadwalader alert retrieved. BPK database retrieved but no consolidated instrument; supplied errata notes conflicting GR 33/36 numbering. Primary source; additional source.

Vietnam: filing plus conditional localisation

Hogan Lovells Cadwalader describes Vietnam’s new personal-data law and transfer-impact-assessment duties. The supplied dated research identifies Law 91/2025/QH15 from 1 January 2026 and later cybersecurity localisation rules. The official database returned 403; the consolidated law/decrees and current localisation scope remain unavailable. Hogan Lovells Cadwalader analysis retrieved; official VBPL database returned 403. Do not treat the legacy Decree 13/2023 alone as a current complete rule. Primary source; additional source.

Nigeria: adequacy-based transfers

NDPA Part VIII governs transfers; GAID Article 45 and Schedule 5 set the adequacy evaluation until the Commission issues an instrument 36. GAID treats reliance on third-party cloud and sovereignty implications as classification factors. Commentary differs on consent 58.

Kazakhstan: storage in Kazakhstan

UPPERSETUP reports that Article 12(2) of Law 94-V, as amended from 25 August 2026, requires storage in a database or digital object in Kazakhstan. It distinguishes local storage from Article 16 transfer conditions. The Adilet official page required JavaScript; the current consolidated text was not retrieved. UPPERSETUP commentary retrieved; Adilet official text unavailable. Scope and exceptions need qualified local review. Primary source; additional source.

How to operationalise residency in a customer data platform (CDP)

Treat the master table as a requirements list, then implement each control per jurisdiction.

1. Region pinning. Make region an immutable property of each store. Pin databases, queues, caches, search indexes, backups, logs and inference endpoints to the same jurisdiction, and test it with infrastructure policy checks. Typical leaks are error trackers, telemetry and analytics sidecars that carry identifiers.
2. Per-jurisdiction tenants. In localisation countries run a separate tenant or cell with its own identity graph. Resolve identities in-region and export only what the law allows, normally aggregates.
3. Key custody. Hold encryption keys in a hardware security module inside the jurisdiction, under customer control, with access logged. For sovereignty concerns, key custody matters more than the data centre's postcode.
4. Support access. Follow-the-sun support and vendor remote access can be transfers. Use in-region staff, just-in-time approval, session recording and break-glass records.
5. Sub-processor lists. Keep a per-region list with each sub-processor's country of storage and processing, and change notification. DORA Article 30(2)(b) already requires named locations and advance notice of change 5.
6. Audit evidence. Keep append-only logs of reads, exports and out-of-region access, plus transfer assessments (Quebec, standard-clause assessments, China and Vietnam filings) and periodic attestations.

Private deployment lets an organisation choose its operating environment and responsibilities; it does not establish compliance by itself. Compare the deployment options, security controls and on-premise guide against your own contracts, access model and jurisdiction assessment.

Decision checklist

1. List the countries where your data subjects live and where you hold legal entities.
2. Classify each with the master table: localisation, transfer_restricted, residency or none.
3. Add sector overlays: health, payments, gaming, public sector.
4. Choose the architecture: single region plus transfer mechanism, region per jurisdiction, or separate stacks for localisation countries.
5. Map every flow: SDKs, queues, identity resolution, activation destinations, support tooling and model inference.
6. Select transfer mechanisms and complete assessments before go-live.
7. Decide key custody and the support-access model.
8. Write location, sub-processor notice, audit and exit clauses into contracts.
9. Build evidence: logs, inventories, attestations.
10. Re-run quarterly against the deadline tracker.

To check a planned deployment against these rules, start with deployment qualification. More in the regulation hub.

Complete reference table

The interactive table below retains every source record, with source links, check dates and explicit research limitations. Use its filters and download the complete CSV.