What Is Data Residency? The Answer, Explained

Data residency is the physical, geographic location where your data is stored and processed — the country or region of the data centres that hold your databases, files, backups and logs. When a company says its data is “resident in the EU”, it means those servers sit inside the European Union. Data residency is a fact about location. It says nothing on its own about which laws can reach the data or who can be forced to hand it over. Those are separate questions, and mixing them up is the most common mistake in a data residency review.

What is data residency?

Every piece of data a company holds lives on some disk in some building. Data residency answers where that building is. Companies usually care about it for three reasons:

• Regulation. Some laws restrict where certain data may be kept or sent: personal data under the GDPR, health or financial records in many countries.
• Contracts. Enterprise and public-sector customers often write a storage location into their procurement questionnaires and contracts, whatever the law strictly requires.
• Latency. Data kept close to its users is faster to reach. This is the reason cloud providers first offered regions, long before compliance came up.

A data residency requirement is therefore usually phrased as “the data must be stored in country X” or “in region Y”, and a provider meets it by running the workload in a data centre there.

Data residency vs data sovereignty vs data localization

Three terms get used as if they meant the same thing. They do not:

Residency is about location, sovereignty about jurisdiction, and localization about a legal duty to keep data in one place. Localization laws exist in a number of countries: Russia (2015), China's Cybersecurity Law (2017) for operators of critical information infrastructure, and India's 2018 Reserve Bank rule that payment data be stored in India. The EU is not on that list. It regulates where personal data may be transferred, not where it must sit.

Sovereignty is where residency on its own falls short. The US CLOUD Act (2018) lets US authorities compel a US-incorporated provider to disclose data it controls even when that data is stored abroad. So a US cloud's EU region gives you EU data residency without EU data sovereignty. Both depend on the provider, not only on the region you pick.

Does the GDPR require data residency?

No. The GDPR does not say personal data must be stored in the EU. Chapter V (Articles 44–50) instead controls transfers of personal data to countries outside the European Economic Area. A transfer is lawful when one of these applies:

• An adequacy decision. The European Commission has found that the destination protects data to an essentially equivalent standard. Countries with one include the UK, Switzerland, Japan and South Korea.
• The EU–US Data Privacy Framework (2023), an adequacy decision that covers only US companies certified under it. It replaced Privacy Shield, which the Court of Justice struck down in Schrems II (2020), which itself had replaced Safe Harbor, struck down in 2015. The EU General Court dismissed the first challenge to the framework in September 2025, and an appeal to the Court of Justice (case C-703/25 P) was lodged that October.
• Standard Contractual Clauses or binding corporate rules, backed by a transfer impact assessment showing that the destination country's laws do not undermine them.

EU data residency is therefore not a legal requirement in itself. In practice it is the simplest way to comply: data that never leaves the EEA involves no transfer, which means no transfer mechanism to choose and no transfer impact assessment to write or keep current. That is why so many procurement reviews ask for it anyway.

EU data residency

For a European company, “EU data residency” usually means three things together: the data is stored in an EU member state, the provider operating it is an EU company, and there is a Data Processing Agreement that names every sub-processor. The first gives you residency. The second removes the CLOUD Act route described above. The third is what an auditor reads. Our guide to EU data residency explains the rules, compares which platforms are actually EU-incorporated, and shows how HostStack keeps apps, databases and backups in Helsinki, Finland, under a Danish company.

What data residency has to cover

A residency claim only holds if it covers every copy of the data, and the main database is rarely the copy that leaks out of the region. When you check a setup, go through each of these layers:

• Application servers: where requests are processed, including any edge or serverless functions that run in whichever region is nearest the visitor.
• Databases and file storage: the primary copy and every replica.
• Backups: often kept in a different region from the primary, and easy to miss.
• Logs and error tracking: request logs routinely contain IP addresses, email addresses and URLs.
• Web analytics: every page view sends the visitor's IP address and URL to the analytics vendor (see below).
• Email and support tools: transactional email providers and helpdesks hold customer names, addresses and message contents.

Data residency for analytics in Europe

Analytics is the layer most often forgotten in a data residency review, because the tag is one line of JavaScript rather than a server you run. But that line sends data about every visitor to the analytics vendor, and where the vendor stores and processes it is a data residency question like any other. Between January and June 2022 the Austrian, French and Italian data protection authorities each found a website's use of Google Analytics unlawful because of transfers to the US. Today the Data Privacy Framework makes transfers to certified US vendors lawful again, but it does not make the data EU-resident.

For analytics with real data residency in Europe, check two things: where the raw events are stored, and where the vendor is incorporated. HostStack's own site analytics stores events in Helsinki under a Danish company and is cookieless by default. The EU data residency guide has a section on data residency for web analytics in Europe.

How to check a provider's data residency

Ask these questions, and ask for the answers in writing:

1. In which country is each copy stored: primary, replicas, backups and logs?
2. Can data leave that region during normal operation, for example through a global CDN, support access or failover?
3. Where is the provider incorporated, and where is its parent company incorporated?
4. Which sub-processors handle the data, and where are they? A published sub-processor list should answer this.
5. Will they sign a Data Processing Agreement on your plan, or only on an Enterprise contract?

If any answer involves a country outside the EEA, you are making a transfer and need one of the mechanisms above. If every answer stays inside the EU, you have data residency, and with an EU-incorporated provider, sovereignty as well.

FAQ