Data localization

Data localization is a legal requirement that certain data, such as payment, health or citizen data, be stored and sometimes processed only within a country's borders.

Localization is set by law or by regulators. Data residency, by contrast, describes where an organisation chooses or agrees to keep data, often in order to meet such a law or a customer's demand. A localization rule can require that the only copy stays in the country, that a full copy stays there while processing happens elsewhere, or that certain data never leave.

Governments usually cite supervisory access for regulators and police, national security, or support for local industry. The costs fall on companies that must run separate systems in each country. For advertising, localization matters most where ad tech touches regulated data: payments, telecoms, health and government. A bank that runs a financial media network, for example, may find that its card data cannot go to a clean room hosted abroad at all.

Localization also differs from transfer rules such as the GDPR's. The GDPR lets personal data leave the EU when safeguards are in place. A localization rule forbids the transfer or demands a copy inside the country.

Example: The Reserve Bank of India's circular of 6 April 2018 requires payment system providers to store all data on the systems they operate only in India (Reserve Bank of India, 6 April 2018). That includes full end-to-end transaction details, although the foreign leg of a transaction may also be stored abroad. Providers had six months to comply and had to report compliance by 15 October 2018.

Related terms: data residency, data sovereignty, sovereign cloud, SCC, CLOUD Act.

Authoritative source: Reserve Bank of India, "Storage of Payment System Data", circular RBI/2017-18/153 (6 April 2018).

Read the full guide: Data residency requirements by country.