Data Residency
Data residency refers to the geographic location where data is stored. Google Cloud’s architecture guidance gives the compact version: data residency describes where your data is stored at rest. A data residency requirement is an obligation — from regulation, contract, or internal policy — that certain data be kept in a particular country or region.
The definition is simple. Satisfying a requirement usually is not, because requirements rarely stop at where the bytes rest.
Residency and neighboring terms
Several terms are used around this idea, and they are not used consistently across vendors, regulators, and contracts. Google Cloud’s framework, for example, separates residency (where data is stored) from data sovereignty, which it describes as mechanisms that prevent the provider itself from accessing customer data, such as keeping encryption keys outside the cloud. Other sources use “sovereignty” to mean being subject to a jurisdiction’s laws, and “localization” for a legal mandate to keep data in-country. When a requirement uses any of these words, read what it actually restricts rather than relying on the label.
What a region setting does and does not settle
Cloud storage is regional by default. AWS, for instance, states that objects stored in an Amazon S3 region never leave it unless explicitly transferred or replicated. That settles where the stored copy sits. A residency requirement can reach further, and a useful check has four parts:
| Question | Why the storage region does not answer it |
|---|---|
| Where is the data stored? | Answered by the region — for the primary copy. Replicas, backups, and disaster recovery copies may be configured elsewhere. |
| Where is it processed? | A query engine, ML service, or support tool in another region may read the data and hold it in memory or temporary storage there. |
| From where can it be accessed? | A table that never leaves its region can still be read by a user in another jurisdiction unless identity and network controls prevent it. |
| Where can results go? | Query results, extracts, and reports are new data. Exporting them can move the protected information even though the source table stayed put. |
Google Cloud’s guidance reflects the same breadth: it recommends controlling not only where data is stored but how it is accessed and processed, and using location policies to restrict where resources can be created and where data can be replicated between regions.
Paths that are easy to miss
- Backups and replicas configured for resilience in a distant region.
- Logs and telemetry that capture query text, parameters, or sample values and are shipped to a central region.
- Caches near users in other regions.
- Metadata. A global catalog copies column names, descriptions, and sometimes profiled sample values into every region. Usually harmless, but not always.
- Shared data across regions. In-place sharing features often create a replica when the consumer is in another region.
Designing for it
Platforms that serve several jurisdictions tend toward regional data with consistent global definitions: each region holds its own data, while the catalog, access policies, and business definitions are the same everywhere. That keeps one description of what exists without moving the data itself. What it cannot do is make a cross-region join free. A workload that must combine data from two jurisdictions needs an explicit decision — aggregate within each region and combine only the summaries, or establish that the transfer is permitted and pay for it.
Residency is a constraint to settle before the architecture, not a setting to optimize within it. Which regulations apply, and what they require, is a question for legal and compliance specialists; this entry explains the engineering side only. How residency interacts with sharing, copies, and cost on a shared platform is worked through in Enterprise Scale: One Platform, Workloads That Disagree.
References: Google Cloud Architecture Framework, Meet regulatory, compliance, and privacy needs; Amazon S3 User Guide, What is Amazon S3?.
Discover more from Insightful Data Lab
Subscribe to get the latest posts sent to your email.