tools

Customer data residency by country

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Find customer data residency and transfer considerations by jurisdiction, with separate health and financial rules. Search the table, inspect the source links and check each record’s confidence and date before making a hosting decision.

This reference uses the supplied research snapshot. “High” maps to its “verified” label; it does not mean this site independently rechecked every legal interpretation. General summaries retain their source-specific evidence. Secondary commentary names its publisher; unavailable statute text and unreviewed sector details are labelled. Confidence describes the general summary, not every sector field. Missing details mean unknown, not permission to transfer data.

How to use this reference

Select your jurisdiction and sector.
Open the regulator or legal text linked to the record.
Confirm the rule, exceptions and your contractual obligations with qualified counsel.

See the country analysis and residency versus sovereignty guide.

Customer Data Residency: Country Rules and Sources

Research snapshot checked on 2026-10-18. Sort any column and retain source dates when reusing records. iAge dataset reuse terms cover the original compilation; third-party source rights remain separate.

Search recordsSectorRule type (choose one or more)ConfidenceRegion Hide low-confidence records

Confidence applies to the general summary: high = verified research, medium = attributed or qualified secondary evidence, low = general rule not established. Sector limitations are stated separately. A “free flow” category is not legal permission to transfer. EU is a supranational code.

The interactive map loads near the viewport. Every record is also available in the table below.

21 of 21 records match.

Scroll horizontally to compare all columns ↔

Customer Data Residency: Country Rules and Sources

free flow	OAIC APP 8 guidance describes reasonable steps before overseas disclosure and section 16C accountability, subject to exceptions. The rule depends on the disclosure and recipient; it is not a general Australian storage mandate.	high (verified)	2026-10-17	Open source
conditional transfer	LGPD Article 33 provides grounds for international transfers, including adequate protection and safeguards. The general LGPD transfer regime is distinct from any betting-operator or financial-sector hosting rule. EU-Brazil adequacy was adopted on 26 January 2026 (supplied verified-facts.md).	high (verified)	2026-10-17	Open source
free flow	PIPEDA Schedule 1 clause 4.1.3 makes an organisation accountable for personal information transferred to a third party for processing, with contractual or other means providing comparable protection. Quebec adds a privacy impact assessment and agreement under section 17. Provincial public-sector rules require a separate assessment.	high (verified)	2026-10-17	Open source
localisation required	PIPL Articles 38-40 distinguish transfer mechanisms and domestic storage/security-assessment duties for critical-information infrastructure operators and handlers above regulatory thresholds (supplied research). The NPC primary URL was unavailable. Current thresholds, 2026 certification measures and exemptions are not independently confirmed here.	medium (secondary)	2026-10-17	Open source
conditional transfer	GDPR Chapter V conditions transfers outside the EEA on adequacy, appropriate safeguards or a specific derogation. It does not impose a general EEA storage requirement. Local storage alone does not resolve third-country access. EU-Brazil adequacy was adopted on 26 January 2026 (Commission Implementing Decision (EU) 2026/179).	high (verified)	2026-10-17	Open source
conditional transfer	DPDP Act section 16 allows the Central Government to restrict transfers to notified countries or territories and preserves stricter laws. G.S.R. 843(E) schedules listed substantive provisions eighteen months after Gazette publication and consent-manager provisions after one year; confirm the operative publication day and amendments before relying on commonly reported November 2026 / May 2027 dates.	high (verified)	2026-10-18	Open source
conditional transfer	Hogan Lovells Cadwalader reports GR 33/2026, promulgated on 16 July 2026 and effective on 16 January 2027, with cross-border provisions in Articles 160-174. The supplied research also identifies public-scope localisation under GR 71/2019. The official BPK link is a database home page, not the instrument text; the reported 2026 number/date remain secondary.	medium (secondary)	2026-10-17	Open source
conditional transfer	The PPC official laws index links the APPI and warns that English translations are reference material. The supplied research describes Article 28 foreign third-party provision using informed consent, an equivalent recipient system or a designated country. The linked old PDF was unavailable; current Article 28 wording and the reported 2026 amendment commencement were not confirmed.	medium (secondary)	2026-10-17	Open source
localisation required	UPPERSETUP reports that Article 12(2) of Law 94-V, as amended from 25 August 2026, requires storage in a database or digital object in Kazakhstan. It distinguishes local storage from Article 16 transfer conditions. The Adilet official page required JavaScript; the current consolidated text was not retrieved.	medium (secondary)	2026-10-17	Open source
conditional transfer	The Trusted Advisors’ analysis on Mondaq reports that the NDPC’s March 2025 GAID implements the NDPA, replaces the NDPR and addresses cross-border transfers. The NDPC PDF returned 403. Current adequacy instruments and the detailed transfer test were not retrieved.	medium (secondary)	2026-10-17	Open source
localisation required	B1 legal commentary reports that Law 23-FZ reworded Article 18(5), effective 1 July 2025, to prohibit recording, storing and related operations on Russian citizens’ personal data using databases outside Russia, with statutory exceptions. B1 says whether a foreign copy may remain is uncertain.	medium (secondary)	2026-10-17	Open source
conditional transfer	Clyde & Co reports proposed amendments to the PDPL Implementing Regulations, with consultation from 6 October to 5 November 2026, including express localisation requirements. These are proposals, not an enacted new storage mandate. The current SDAIA document was rejected by the host.	medium (secondary)	2026-10-17	Open source
conditional transfer	The supplied research describes the PDPA section 26 comparable-protection test for overseas transfers. The current statute and regulator page did not yield readable text in this refresh. The precise exceptions and 2021 Regulations Part 3 remain unavailable; do not treat this summary as a verified permission.	medium (secondary)	2026-10-17	Open source
conditional transfer	The supplied verified research describes POPIA section 72 as conditioning foreign transfers on adequate protection through law, binding corporate rules or agreement, or specific statutory alternatives. The official government PDF timed out in this refresh; sector rules were not reviewed.	high (verified)	2026-10-18	Open source
conditional transfer	The supplied research identifies PIPA Article 28-8 as the overseas-transfer provision. The supplied KLRI URL returned an incomplete law page and the Chambers secondary link was unavailable. Current grounds, the reported 2026 fine increase and commencement have not been established in this refresh.	low (unconfirmed)	2026-10-17	Open source
conditional transfer	The FDPIC explains that foreign disclosure requires adequate protection or an Article 16 safeguard; Article 17 provides specific exceptions. This is a transfer assessment, not a universal Swiss storage mandate. Banking and other sector duties need a separate review.	high (verified)	2026-10-17	Open source
conditional transfer	The KVKK official English text shows Article 9 amended by Law 7499. Transfers can use an adequacy decision with an Article 5 or 6 condition; where adequacy is absent, the provision provides appropriate-safeguard and limited incidental routes. Standard contracts must be notified within five working days.	high (verified)	2026-10-17	Open source
conditional transfer	Federal, free-zone and sector rules must be assessed separately. DLA Piper’s January 2025 guide reported unpublished federal Executive Regulations; their current issuance status is unavailable. The UAE government page did not return readable content in this refresh.	medium (secondary)	2026-10-17	Open source
conditional transfer	UK international transfers use adequacy regulations, appropriate safeguards or exceptions. The Data (Use and Access) Act transfer changes commenced on 5 February 2026 under SI 2026/82. EU adequacy for the UK was renewed to 27 December 2031 by Commission Decision C(2025) 8771 final.	high (verified)	2026-10-17	Open source
free flow	28 CFR Part 202 prohibits or restricts covered transactions that expose bulk US sensitive personal data or government-related data to countries of concern or covered persons. Its thresholds vary by data type; for health and financial data the threshold is more than 10,000 US persons. This is not a universal prohibition on foreign hosting.	high (verified)	2026-10-17	Open source
localisation required	Hogan Lovells Cadwalader describes Vietnam’s new personal-data law and transfer-impact-assessment duties. The supplied dated research identifies Law 91/2025/QH15 from 1 January 2026 and later cybersecurity localisation rules. The official database returned 403; the consolidated law/decrees and current localisation scope remain unavailable.	medium (secondary)	2026-10-17	Open source

Download full CSV

General information, not legal advice. Read the supporting analysis.

Frequently asked questions

What does this reference show?

It lists supplied jurisdiction summaries, sector rules, source links, confidence labels and research check dates. Some details are explicitly unconfirmed.

What do the confidence labels mean?

High maps to the supplied verified label, medium to secondary research, and low to a general rule that could not be established from the available sources. These are research labels, not legal approval.

How should I check a rule?

Open the linked primary source and confirm the current text, exceptions, sector scope and contractual requirements with qualified counsel.

Can I download the data?

Yes. Use the full CSV or filtered CSV controls. Retain source and date columns. The iAge dataset reuse terms cover the original compilation and summaries; third-party laws and source material keep their own terms.

Is this legal advice?

No. This is a navigation aid for a legal and technical assessment. It does not establish permission to store or transfer personal data.

Sources

schema.org Dataset Open source
Google Search Central, Dataset structured data Open source
W3C, Web Content Accessibility Guidelines 2.2 Open source

Put this evaluation into practice.

Assess your deployment requirements

This article is general information, not legal advice.