Data residency requirements by country: what each law means for advertising data

The three terms answer different questions. Vendors often use them as if they meant the same thing.

Localization is a legal mandate, and residency is often a business choice. Sovereignty is about control, which is why our page on why data sovereignty defines the future of ad tech treats it as an architecture question. Our guide to the EU sovereign ad tech stack explains how the US CLOUD Act bears on data stored in the EU. The glossary entry for data localization gives the short form.

How to read the table. "In-country" means the text requires storage or processing inside the territory for the data it names. "Conditional" means data may leave once a listed condition is met. Every date was checked on the last-updated date above. The last column is our reading of where the rule meets bid requests and audience data; it is not a legal conclusion for any data flow.

What the law requires. The GDPR has no general rule that personal data must be stored in the EU. Article 44 says any transfer to a third country "shall take place only if" the Chapter V conditions are met, including for onward transfers (GDPR, Article 44). Article 45 allows transfers to countries with an adequacy decision. Article 46(2) lists safeguards that need no specific authorisation, including standard data protection clauses and binding corporate rules. Article 49 adds narrow derogations, such as explicit consent. The standard clauses are often called SCCs.

What regulators and courts have said. The Commission's list now covers 16 countries and territories plus the European Patent Organisation. The UK decisions were renewed on 19 December 2025, Brazil was added on 26 January 2026, and Korea passed its first review on 23 July 2026 (European Commission).

The EU-US Data Privacy Framework applies only to US organisations on the DPF list. Its legality is before the Court of Justice in C-703/25 P; on 9 November 2026 InfoCuria showed the case as pending, with an order dated 4 June 2026 (InfoCuria). The EDPB's Recommendations 01/2020 describe supplementary measures for transfers that rely on Article 46 tools (EDPB, 18 June 2021).

What practitioners do. Many EU publishers and ad tech firms keep a vendor-by-vendor record of which transfer tool covers each non-EEA recipient, with SCCs as a fallback if the DPF falls. That is practice, not a legal requirement. The consent side of the same bid request is covered in our guide to GDPR, ePrivacy and the bidstream.

United Kingdom. The Data (Use and Access) Act 2025 rewrote the UK transfer rules around a "data protection test". A country passes if its protection is "not materially lower" than UK protection (UK GDPR, Article 45B). Schedule 7 came fully into force on 5 February 2026 (S.I. 2026/82).

Exporters using Article 46 safeguards must themselves judge, "acting reasonably and proportionately", that the test is met. The UK-US data bridge has covered organisations in the UK extension of the DPF since 12 October 2023 (S.I. 2023/1028). Our UK Data (Use and Access) Act guide covers the cookie and advertising changes in the same Act.

Switzerland. The Federal Act on Data Protection has applied since 1 September 2023. It allows disclosure abroad where the Federal Council has found a country adequate, or where safeguards such as recognised contract clauses apply (FADP, Articles 16 and 17). The Swiss list in Annex 1 of the ordinance includes US organisations certified under the Swiss-US DPF since 15 September 2024. It does not list Japan, Korea or Brazil, which the EU treats as adequate (DPO, Annex 1).

What the law requires. No federal statute requires commercial advertising data to be stored in the US. The binding rules point the other way: they stop data from going to named countries. The Justice Department rule at 28 CFR Part 202 has applied since 8 April 2025. It prohibits data brokerage of bulk US sensitive personal data to covered persons linked to China, Cuba, Iran, North Korea, Russia and Venezuela (28 CFR 202.601). "Covered personal identifiers" become bulk above 100,000 US persons in 12 months, and precise geolocation above 1,000 devices (§ 202.205).

The rule speaks to ad tech by name. Its list of identifiers includes "Advertising identifier (such as Google Advertising ID, Apple ID for Advertisers...)" and IP addresses (§ 202.234). Example 4 in § 202.214 describes an app that sells ad space and passes the IP addresses and ad IDs of more than 100,000 users to an ad exchange in a country of concern. The rule calls that a prohibited transaction.

Example 5 moves the exchange to the US: the app's sale is then not a covered transaction, but the exchange's onward sale to advertisers in a country of concern is data brokerage (eCFR).

The Protecting Americans' Data from Foreign Adversaries Act of 2024 adds a second ban for data brokers, enforced by the FTC (15 U.S.C. 9901). Real in-country rules exist only in federal sectors. Cloud contractors must keep DoD government data in the US or outlying areas (DFARS 252.239-7010). Federal tax information "must not be received, processed, stored, accessed, or transmitted" to offshore systems (IRS Publication 1075, section 2.C.7).

States. Our research found no state statute that requires private-sector consumer data to be stored in-state. State privacy laws regulate sale, sharing and targeted advertising instead; see the US state privacy laws tracker.

Federal law. PIPEDA does not block transfers. The Privacy Commissioner's 2009 guidelines say it "does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing" (OPC, 27 January 2009). The sending organisation stays accountable and is expected to use contracts for comparable protection.

Quebec. Law 25 added a stricter test for private businesses. Since 22 September 2023, section 17 has required a privacy impact assessment "before communicating personal information outside Québec" (CQLR c. P-39.1, section 17). The assessment weighs sensitivity, purposes, safeguards and the foreign legal framework. Data may go only if it would receive "adequate protection", under a written agreement. The same applies when an outside party collects or keeps data on the business's behalf, which covers many ad tech vendors.

Public sector. Nova Scotia's PIIDPA keeps public-body data in Canada unless an exception applies (PIIDPA, section 5).

Brazil. LGPD Article 33 lists the cases in which international transfer "is permitted" (LGPD, Article 33). ANPD Resolution 19/2024, published on 23 August 2024, set standard clauses that must be adopted without changes. Existing clause-based transfers had 12 months to switch (Resolution CD/ANPD 19/2024). In January 2026 the EU and Brazil adopted mutual adequacy decisions (European Commission, 27 January 2026).

India. The DPDP Act uses a negative list: section 16 lets the government restrict transfers to countries it notifies (DPDP Act 2023). Rule 15 of the DPDP Rules 2025 allows transfers subject to requirements on making data available to foreign states. Rule 13(4) goes further for Significant Data Fiduciaries: data the government specifies, and its traffic data, may not leave India (DPDP Rules 2025). Both rules commence 18 months after publication on 13 November 2025. Payment-system data has been subject to an in-India storage directive since 2018 (RBI, 6 April 2018).

China. PIPL Article 40 requires critical information infrastructure operators, and processors that reach CAC volume thresholds, to store personal information collected in China inside China (PIPL). Exports then need a security assessment. The 2024 Provisions set the bands: under 100,000 people of non-sensitive data a year is exempt; standard contract or certification applies up to 1 million; above that, a security assessment (CAC, 22 March 2024). Article 3 exempts marketing data that contains no personal information or important data.

Russia. Article 18(5) of Federal Law 152-FZ says that recording, storing and similar operations on Russian citizens' personal data "using databases located outside the territory of the Russian Federation are not permitted", with listed exceptions. The amended wording has applied since 1 July 2025 (152-FZ, Article 18). Transfers abroad of copies are a separate step under Article 12. The operator must notify Roskomnadzor first, and the authority may ban or restrict the transfer.

Saudi Arabia. The Personal Data Protection Law allows transfers abroad under Article 29 and its transfer regulation. SDAIA's knowledge centre publishes the regulation, standard contractual clauses, a binding corporate rules guide and a transfer risk-assessment guide (SDAIA). The law also covers processing of residents' data by entities outside the Kingdom.

United Arab Emirates. Federal Decree-Law No. 45 of 2021 permits transfers to countries found adequate, or under Article 23 conditions. A law firm reported in 2026 that the executive regulations remain unpublished and no adequacy list has been issued (Kayrouz & Associates, updated 22 October 2026). The DIFC and ADGM free zones run their own data protection laws, lists and clauses.

Indonesia. Article 56 of the PDP Law sets a cascade: equal or higher protection abroad, then adequate and binding safeguards, then consent (PDP Law, ABNR translation). The law took full effect on 17 October 2024. Government Regulation 71 of 2019 separately requires public-scope electronic system operators to keep systems and data in Indonesia (GR 71/2019).

Vietnam. The Personal Data Protection Law took effect on 1 January 2026. A transferor must prepare a transfer impact assessment and file it within 60 days of the first transfer (Rajah & Tann, 1 July 2025). The same firm lists advertising among the sectors with specific rules. The Cybersecurity Law 2025, in force since 1 July 2026, requires in-scope telecom and internet providers that collect user data to store it in Vietnam (Cybersecurity Law 2025, Article 25).

Australia. APP 8.1 requires "such steps as are reasonable in the circumstances" so an overseas recipient does not breach the APPs, and section 16C keeps the sender liable (Privacy Act 1988). The OAIC explains the exceptions in its APP 8 guidelines (OAIC). My Health Record system data is the true localization case: section 77 restricts holding the records outside Australia (My Health Records Act 2012).

Japan and South Korea. Japan's APPI Article 28 requires prior consent for provision to a foreign third party, unless the country is designated or the recipient runs an equivalent system (APPI). The EU-Japan mutual framework has applied since 23 January 2019 (PPC). Korea's PIPA Article 28-8 starts from a prohibition on providing, outsourcing or storing personal information abroad, then lists exceptions such as separate consent and certification (PIPA).

This section is our analysis of the rules above, not a statement of law for any data flow. A bid request often carries an IP address, a device ID and a consent string. When it leaves a country for many bidders at once, each recipient can raise a different question.

Scenario. A Brazilian news site sends each bid request to 30 bidders: 12 in the EU, 10 in the US and 8 elsewhere. Brazil's LGPD Article 33 applies to every one of them. For the 12 EU bidders, Brazil's January 2026 adequacy decision for the EU supplies the basis. The other 18 each need another Article 33 route, such as the ANPD standard clauses. If the site moved its auction to an in-country server and sent only contextual signals, the number of transfers would fall. The rules would stay the same.

Audience data in a clean room raises the question once per partner instead of once per auction. Where the room runs, and who can query it, decides which rows of the table apply. For where to host such workloads, see our comparison of sovereign cloud providers. The wider context is collected on the data sovereignty hub.

1. Regulation (EU) 2016/679 (GDPR), Articles 44 to 49. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
2. European Commission, "Adequacy decisions" (checked 9 November 2026). https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
3. European Commission, "The EU and Brazil conclude agreements to create the biggest area of free and safe data flows in the world" (27 January 2026). https://ec.europa.eu/commission/presscorner/detail/en/ip_26_229
4. European Commission, "Commission finds that Republic of Korea continues to provide an adequate level of protection of personal data" (23 July 2026). https://commission.europa.eu/news-and-media/news/commission-finds-republic-korea-continues-provide-adequate-level-protection-personal-data-2026-07-23_en
5. Commission Implementing Decision (EU) 2023/1795, EU-US Data Privacy Framework (10 July 2023). EUR-Lex. https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj
6. Court of Justice of the EU, InfoCuria, case C-703/25 P, Latombe v Commission (checked 9 November 2026). https://curia.europa.eu/juris/liste.jsf?num=C-703/25&language=en
7. EDPB, Recommendations 01/2020 on measures that supplement transfer tools, version 2.0 (18 June 2021). https://www.edpb.europa.eu/documents/recommendation/recommendations-012020-on-measures-that-supplement-transfer-tools-to_en
8. UK GDPR, Article 45B, as amended by the Data (Use and Access) Act 2025. legislation.gov.uk. https://www.legislation.gov.uk/eur/2016/679/article/45B
9. Data (Use and Access) Act 2025, Schedule 7. legislation.gov.uk. https://www.legislation.gov.uk/ukpga/2025/18/schedule/7
10. The Data (Use and Access) Act 2025 (Commencement) Regulations, S.I. 2026/82. legislation.gov.uk. https://www.legislation.gov.uk/uksi/2026/82/made