Data residency in banking and finance

The three terms answer different questions. IBM defines residency as the physical or geographic location of data, data localization as a mandate that data stay in a specific place and jurisdiction, and data sovereignty as control over data based on where it is stored and processed. Teradata adds the point that trips up projects: backups and disaster recovery copies are part of the residency scope, and a failover to a region in another country moves data across a border without anyone deciding to.

Residency does not settle which state can demand the data. A European data center run by a company under United States law is in reach of the CLOUD Act, so a bank reads residency and jurisdiction as two separate clauses, which the page on sovereign cloud for banks takes apart.

BaFin's notice lists what a bank assesses before a cloud contract: the location where data is stored or processed, the location of the provider's head office, the geopolitical situation, and the laws in those jurisdictions, including data protection, law enforcement and the insolvency rules that would apply if the provider failed. Among the contract terms it suggests is a restriction of the permitted cloud services and of the locations or regions of the data centers.

The ECB's guide on cloud outsourcing goes in the same direction for the banks it supervises directly: data stays in approved jurisdictions chosen with legal and political risk in mind, and the bank checks with tracing tools where the data actually sits.

The large providers have built residency into products. Microsoft completed its EU Data Boundary in February 2025, with a last phase that keeps professional services data, such as customer logs sent to support and the case notes of support staff, in the EU and EFTA. Amazon Web Services launched its European Sovereign Cloud in January 2026, with a first region in Brandenburg that is separate from the other AWS regions.

Both answers settle where the data is. In a French Senate hearing in June 2025, Microsoft France's director of public and legal affairs said under oath that he could not guarantee French data would never reach US authorities without French consent. Jurisdiction is a question of its own, and the page on the CLOUD Act covers it.

A generative AI service moves data in ways a database does not. Every prompt that carries a customer name is a transfer of personal data to wherever the model runs, and the provider may keep logs of prompts and outputs. A residency clause for AI therefore names the inference location and the retention period for prompts. The page on AI infrastructure in banking covers the options from a hosted API to a model on the bank's own servers.

Data residency says where the data is stored and processed. Data sovereignty says which country's law governs the data and which authorities can reach it. Data in Frankfurt can be resident in Germany and still be subject to a foreign disclosure order if the operator falls under foreign law.

No. The GDPR regulates transfers outside the EU and the EEA through adequacy decisions, standard contractual clauses or binding corporate rules, and does not prohibit them as such. Residency requirements for banks come mostly from contracts and from what supervisors expect.

Neither DORA nor the BaFin notice on cloud outsourcing sets a rule that data must stay in Germany. Both expect the bank to know where its data is and to assess the legal and political risk of each location, and the contract can restrict locations where that risk calls for it.