{"page":"/blog/data-residency-requirements-by-country","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Jurisdiction","Law and pinpoint","In-country or conditional","Conditions for data to leave","Status and dates (checked 9 Nov 2026)","Relevance to bidstream and audience data"],"rows":[["EU and EEA","GDPR Articles 44 to 49 (EUR-Lex)","Conditional; no general storage rule","Adequacy decision (Article 45); safeguards such as standard clauses, BCRs, codes or certification (Article 46(2)); derogations (Article 49)","Adequacy list covers 16 countries and territories plus the European Patent Organisation (Commission)","Each non-EEA bidder or data partner that receives personal data is a separate transfer question"],["EU to US","Implementing Decision (EU) 2023/1795, Data Privacy Framework (EUR-Lex)","Conditional","Recipient certified under the DPF; otherwise Article 46 tools","Adopted 10 July 2023; appeal C-703/25 P pending (InfoCuria)","US DSPs and measurement vendors differ by DPF status"],["United Kingdom","UK GDPR Articles 44A, 45A, 45B and 46 as amended by the Data (Use and Access) Act 2025, Schedule 7 (legislation.gov.uk)","Conditional","UK adequacy regulations under a \"data protection test\"; Article 46 safeguards where the exporter, \"acting reasonably and proportionately\", finds the test met (Article 45B)","Schedule 7 fully in force 5 February 2026 (S.I. 2026/82); UK-US data bridge since 12 October 2023 (S.I. 2023/1028)","UK and EU lists can diverge over time"],["Switzerland","Federal Act on Data Protection, Articles 16 and 17; Data Protection Ordinance Annex 1 (Fedlex)","Conditional","Federal Council country list; contract clauses notified to or recognised by the FDPIC; BCRs; Article 17 exceptions such as explicit consent","In force 1 September 2023; Swiss-US DPF listed since 15 September 2024; Annex 1 does not list Japan, Korea or Brazil (DPO, version of 1 December 2025)","A Swiss audience segment follows a different list from the EU's"],["United States (federal, national security)","28 CFR Part 202, Justice Department rule on bulk sensitive data (eCFR)","No residency rule; outbound ban","Prohibits data brokerage of bulk data to China, Cuba, Iran, North Korea, Russia and Venezuela; thresholds include more than 100,000 people for covered personal identifiers and more than 1,000 devices for precise geolocation (§ 202.205)","Effective 8 April 2025 (§ 202.216)","§ 202.214 Example 4: ad IDs and IP addresses of more than 100,000 users sent to an ad exchange in a country of concern is prohibited brokerage"],["United States (data brokers)","Protecting Americans' Data from Foreign Adversaries Act of 2024, 15 U.S.C. 9901 (govinfo)","No residency rule; outbound ban","Data brokers may not make sensitive data of US individuals available to a foreign adversary country or an entity it controls; FTC enforces","Effective 60 days after enactment on 24 April 2024 (our calculation: 23 June 2024)","Covers sale of audience data that includes sensitive categories"],["United States (federal sectors)","DFARS 252.239-7010(b)(3) (acquisition.gov); IRS Publication 1075, section 2.C.7 (IRS)","In-country for DoD government data and federal tax information","DoD data held by cloud contractors stays in the US or outlying areas; tax data may not be stored or accessed offshore","Clause dated January 2023; Publication 1075 revision 11-2021","Matters only for agencies and contractors running campaigns with those data sets"],["United States (states)","No statute found","n/d","Our search found no state law that requires private-sector consumer data to be stored in-state","Checked 9 November 2026; see the US state privacy laws tracker","State laws regulate sale and sharing, not storage location"],["Canada (federal)","PIPEDA Schedule 1, clause 4.1.3, read with OPC guidelines of 27 January 2009 (OPC)","Conditional; accountability model","The transferring organisation stays accountable and uses contracts for \"a comparable level of protection\"","Guidelines dated 27 January 2009","A Canadian publisher remains answerable for data its US vendors process"],["Quebec","Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, section 17 (LégisQuébec)","Conditional","Privacy impact assessment covering sensitivity, purposes, safeguards and the foreign legal framework; \"adequate protection\"; a written agreement","Current text in force since 22 September 2023","Applies when an outside vendor collects, uses or keeps data for the enterprise"],["Nova Scotia (public bodies)","Personal Information International Disclosure Protection Act, section 5(1) (Nova Scotia Legislature)","In-country for public bodies and their service providers","Consent, a disclosure the Act permits, or approval by the head of the public body","Consolidation dated October 2026","Relevant to public-sector campaigns only"],["Brazil","LGPD, Law 13.709/2018, Article 33 (Câmara dos Deputados); ANPD Resolution CD/ANPD 19/2024 (Diário Oficial)","Conditional","Adequacy; ANPD standard clauses adopted without changes; BCRs; other Article 33 cases","Resolution published 23 August 2024, with 12 months to adopt the ANPD clauses (our calculation: by 23 August 2025); EU and Brazil adopted mutual adequacy decisions in January 2026 (Commission, 27 January 2026)","EU-Brazil audience flows now rest on adequacy in both directions"],["India","DPDP Act 2023, section 16 (MeitY); DPDP Rules 2025, rules 13(4) and 15 (Gazette); RBI directive of 6 April 2018 (RBI)","Conditional by default; in-country for payment-system data and for data specified for Significant Data Fiduciaries","Government may restrict transfers to notified countries (section 16); rule 15 lets data leave subject to requirements on access by foreign states","Rules published 13 November 2025; rules 13 and 15 commence 18 months later (our calculation: about 13 May 2027)","A platform designated a Significant Data Fiduciary may have to keep specified data \"and the traffic data pertaining to its flow\" in India"],["China","PIPL Articles 38 to 40 (NPC); CAC Provisions on cross-border data flows (CAC, 22 March 2024); certification measures (CAC)","In-country for critical information infrastructure operators and processors above CAC thresholds, unless they pass a security assessment; otherwise conditional","Security assessment, standard contract or certification, plus separate consent (Article 39); exemption below 100,000 people of non-sensitive data a year","PIPL in force 1 November 2021; Provisions effective 22 March 2024; certification measures effective 1 January 2026","Article 3 of the Provisions exempts marketing data that contains no personal information"],["Russia","Federal Law 152-FZ, Articles 12 and 18(5) (ConsultantPlus)","In-country for recording and storing citizens' data; transfers conditional","Article 18(5) bars these operations \"using databases located outside\" Russia, with listed exceptions; Article 12 requires prior notice to Roskomnadzor, which may restrict transfers","Article 18(5) as amended by Law 23-FZ in force 1 July 2025; Law 265-FZ of 26 July 2026 rewrites Article 12 criteria","A tag that writes Russian users' data straight to a foreign database meets Article 18(5)"],["Saudi Arabia","Personal Data Protection Law, Royal Decree M/19, amended by Royal Decree M/148, Article 29; Regulation on Personal Data Transfer outside the Kingdom (SDAIA)","Conditional","Conditions in the transfer regulation; SDAIA publishes standard contractual clauses, a BCR guide and a transfer risk-assessment guide","In force; Gregorian dates n/d","The law reaches processing of residents' data by entities outside the Kingdom (Article 2)"],["United Arab Emirates","Federal Decree-Law No. 45 of 2021, Articles 22 and 23; DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021","Conditional","Mainland: adequacy determination or Article 23 conditions; DIFC and ADGM run their own adequacy lists and clauses","Executive regulations unpublished and no mainland adequacy list issued, per Kayrouz & Associates (secondary, updated 22 October 2026) (Kayrouz & Associates)","Free-zone and mainland entities follow different transfer rules"],["Indonesia","Law No. 27 of 2022 (PDP Law), Article 56 (ABNR translation.pdf)); Government Regulation 71 of 2019, Articles 20 and 21","PDP Law conditional; GR 71/2019 in-country for public-scope electronic system operators","Recipient country protection \"equal to or higher\"; otherwise adequate and binding safeguards; otherwise consent","Full effect 17 October 2024 after a two-year adjustment period; Constitutional Court upheld Article 56 in January 2026 (Hukumonline)","Private ad platforms are private-scope operators and may store abroad under GR 71/2019"],["Vietnam","Personal Data Protection Law No. 91/2025/QH15; Cybersecurity Law No. 116/2025/QH15, Article 25(3) (Hệ thống Pháp luật)","PDP Law conditional; in-country storage for in-scope telecom and internet providers","Transfer impact assessment filed with the authority within 60 days of the first transfer (Rajah & Tann, 1 July 2025)","PDP Law in force 1 January 2026; Cybersecurity Law 2025 in force 1 July 2026, replacing the 2018 law","The PDP Law has sector rules for advertising services"],["Australia","Privacy Act 1988, APP 8 and section 16C (Federal Register of Legislation); My Health Records Act 2012, section 77 (Federal Register of Legislation)","APP 8 conditional; My Health Record system data in-country","Reasonable steps so the overseas recipient does not breach the APPs; the sender stays liable (section 16C); exceptions in APP 8.2","APP 8 amended by the Privacy and Other Legislation Amendment Act 2024 (assent 10 December 2024), adding a prescribed-countries mechanism","An Australian advertiser answers for an offshore vendor's handling of its audience data"],["Japan","APPI (Act No. 57 of 2003), Article 28 (e-Gov)","Conditional","Prior consent with information on the foreign regime; no consent needed for designated countries or recipients with an equivalent system","EU-Japan mutual framework in force 23 January 2019 (PPC)","Sharing segments with a non-designated foreign partner engages Article 28"],["South Korea","Personal Information Protection Act, Article 28-8 (law.go.kr)","Conditional; default prohibition with exceptions","Separate consent; law or treaty; contract necessity with disclosure; certification; PIPC equivalence finding","Version in force 11 September 2026; EU adequacy confirmed after review on 23 July 2026 (Commission)","Article 28-8 counts storage abroad, and making data viewable abroad, as a transfer"]],"sourceUrls":[["https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en"],["https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj","https://curia.europa.eu/juris/liste.jsf?num=C-703/25&language=en"],["https://www.legislation.gov.uk/ukpga/2025/18/schedule/7","https://www.legislation.gov.uk/eur/2016/679/article/45B","https://www.legislation.gov.uk/uksi/2026/82/made","https://www.legislation.gov.uk/uksi/2023/1028/made"],["https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/en/html/fedlex-data-admin-ch-eli-cc-2022-491-20250707-en-html.html","https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/568/20251201/en/html/fedlex-data-admin-ch-eli-cc-2022-568-20251201-en-html.html"],["https://www.ecfr.gov/current/title-28/chapter-I/part-202"],["https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap123-sec9901.htm"],["https://www.acquisition.gov/dfars/252.239-7010-cloud-computing-services.","https://www.irs.gov/pub/irs-pdf/p1075.pdf"],[],["https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/"],["https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1"],["https://nslegislature.ca/sites/default/files/legc/statutes/personal%20information%20international%20disclosure%20protection.pdf"],["https://www2.camara.leg.br/legin/fed/lei/2018/lei-13709-14-agosto-2018-787077-normaatualizada-pl.html","https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396","https://ec.europa.eu/commission/presscorner/detail/en/ip_26_229"],["https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf","https://egazette.gov.in/WriteReadData/2025/267650.pdf","https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244&Mode=0"],["http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html","https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm","https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm"],["https://www.consultant.ru/document/cons_doc_LAW_61801/cbf4e15b7c330f9372e876cdf2bc928bad7950ef/"],["https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter"],["https://www.kayrouzandassociates.com/insights/cross-border-data-transfers-under-uae-law-in-2026"],["https://www.abnrlaw.com/lib/files/IND-ENG-UU%2027-2022%20Pelindungan%20Data%20Pribadi%20(ABNR).pdf","https://www.hukumonline.com/berita/a/transfer-data-lintas-negara-dan-ilusi-pelindungan-data-pribadi-pasca-putusan-mk-lt6981468330d9c/"],["https://hethongphapluat.com/luat-an-ninh-mang-2025","https://www.rajahtannasia.com/viewpoints/new-law-on-personal-data-protection-comes-into-operation-on-1-january-2026"],["https://www.legislation.gov.au/C2004A03712/latest","https://www.legislation.gov.au/C2012A00063/latest"],["https://laws.e-gov.go.jp/api/1/lawdata/415AC0000000057","https://www.ppc.go.jp/en/aboutus/roles/international/cooperation/20190123/"],["https://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EA%B0%9C%EC%9D%B8%EC%A0%95%EB%B3%B4%EB%B3%B4%ED%98%B8%EB%B2%95","https://commission.europa.eu/news-and-media/news/commission-finds-republic-korea-continues-provide-adequate-level-protection-personal-data-2026-07-23_en"]]}