Data residency

Data residency is the requirement, or the choice, that data be stored and processed within a specified geographic or legal jurisdiction, such as a country or the European Union, usually to satisfy a law, a regulator or a contract.

Residency is a property of location. It is satisfied by choosing a cloud region, a data center or an on-premise site inside the required territory and by preventing replication outside it. It is distinct from data sovereignty, which is about which law governs the data and who can compel access to it. Under GDPR, a transfer of personal data outside the EU and EEA is lawful only under the mechanisms of Chapter V (Articles 44 to 49): an adequacy decision, standard contractual clauses or binding corporate rules, with Article 48 providing that a foreign court or authority's order is not by itself a lawful basis for transfer (EUR-Lex, Regulation (EU) 2016/679). Residency inside the EU avoids the transfer question for storage; it does not by itself answer the sovereignty question when the operator is subject to foreign law.

In ad tech, residency bites in three places: the bidder and its logs (every bid request carries an IP address and identifiers), the clean room (where loyalty or transaction data is matched), and the consent records. Cloud providers now sell residency as a product; AWS describes its European Sovereign Cloud as "a new, independent cloud for Europe" that is "independently operated" (AWS, Digital sovereignty in Europe, accessed 17 October 2026). Whether that is enough depends on the next entry.

Example: a German retailer requires that loyalty data never leave Germany; it deploys its ad server, bidder and clean room in a Frankfurt region or its own data center, configures the DSP partner to receive only pseudonymous segment IDs, and blocks cross-region replication; residency is met, and the sovereignty analysis still has to be done.

Related: data sovereignty, CLOUD Act, clean room, TCF.

Source: Regulation (EU) 2016/679 (GDPR), Chapter V.

1. EUR-Lex, Regulation (EU) 2016/679
2. AWS, Digital sovereignty in Europe, accessed 17 October 2026