Data residency
Data residency is where an organisation's data is stored and processed, and the rules — a law, a regulation or a contract term — that can tie that storage and processing location to a particular country or region rather than leave the choice open to whoever runs the system.
Submit a project See delivery by marketReviewed by Huy Nguyen (David), CEO · Updated 27 Oct 2026 · 4 min read
This term is one of the entries in the OutsourcingVN glossary of words buyers meet while checking where a supplier would actually keep their data.
Why does data residency matter?
Where data physically sits decides which local regulations govern it, which is why a buyer checks residency separately from checking who is allowed to see the data. OutsourcingVN is operated by Netbase JSC, and Google Cloud's own documentation defines the idea directly: "data residency refers to the physical location of data and the local regulations that govern how you store, encrypt, and access that data." Moving data across a border is a separate question from where it rests day to day; the European Commission's page on international transfers states that "when personal data is transferred outside the European Economic Area, special safeguards are foreseen to ensure that the protection travels with the data."
What is an example of data residency in practice?
A software buyer operating across several countries asks a cloud-hosted application vendor where customer data will actually be stored. The vendor's platform documentation answers this at the infrastructure level: Google Cloud's own Cloud SQL documentation states that a customer "can select the region when you create your Cloud SQL instance, or you can edit the region by editing an existing instance," and that once a region is chosen, data at rest is kept only in that region under the provider's own terms. The buyer's decision is then which named region to pick, informed by where its users and its own regulatory obligations sit, not a general promise that the provider "keeps data safe."
What are the common misreadings of data residency?
Data residency, data localisation and cross-border transfer rules are three different things that get folded into one conversation. Data residency is simply where data is stored and processed today. Data localisation is a legal requirement that specific data stay inside a given country, and whether one applies is a market-specific question for the software delivery by market guide to answer rather than this entry. Cross-border transfer rules are the separate conditions, such as the mechanisms the European Commission lists — adequacy decisions, standard contractual clauses and binding corporate rules among them — that govern moving personal data to another country once it is already stored somewhere. A system can satisfy a residency preference while still needing a transfer mechanism to move personal data elsewhere for support or backup.
Plan the next step for your project
Common questions
Not on its own; backups, support access and third-party services can still move data unless the contract and configuration specifically restrict that, which is why the data processing agreement matters alongside the region choice.
No. The concept applies wherever a buyer or a regulator cares where data is stored; Google Cloud's documentation, for example, tells users to follow "the data residency regulations of the host country."
Which decisions does data residency affect?
Deciding what to ask a prospective supplier about data handling in general, including where data is stored and processed, is covered in the data security and compliance guide, and the data processing agreement entry covers the contract between a controller and its processor. Where a buyer's own market imposes narrower rules than a general residency preference, the software delivery by market guide is the place to check that market by name. When you know which countries your data has to sit in or avoid, describe it and Netbase will respond through Netbase's own outsourcing-services platform; submit a project when you are ready.