Data Residency.

The requirement that data is physically stored and, in some interpretations, processed within a specific country or region, often driven by contracts, customer demands, or sector regulation. It belongs to the Privacy & Data Protection category of cybersecurity.

The requirement that data is physically stored and, in some interpretations, processed within a specific country or region, often driven by contracts, customer demands, or sector regulation.

Data residency designates the geographic location where data is kept at rest, typically expressed through cloud-region selection, EU/EEA-only storage, in-country backups, or contractual commitments such as standard contractual clauses. It is distinct from data sovereignty, which adds the question of whose laws apply, and from cross-border transfer rules under GDPR Chapter V, China's PIPL, or India's DPDP Act. Organizations implement residency through tenant-region pinning, key management with customer-managed keys, audit-log scoping, encryption that prevents foreign jurisdiction access, and supplier due diligence. Residency is increasingly used as a procurement differentiator and to meet healthcare, financial-services, or public-sector mandates.

Defences for Data Residency typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Geographic Storage Requirements, In-Region Storage.