What is data residency?

Data residency is the physical or declared geographic location where data is stored and processed. It answers where primary copies, backups and temporary data live. Data sovereignty asks which laws and authorities can reach the data. Data localization is a legal requirement to keep specified data within a country or region.

A residency map follows data through databases, object storage, logs, caches, support tools and disaster-recovery copies. A contract that names one region for the main database may say nothing about telemetry or support exports. Banks therefore document each data class and each lifecycle stage, including deletion. The evidence comes from architecture, configuration and provider records, not a region name alone.

Residency supports privacy, banking secrecy, supervisory access and recovery planning. It can also reduce latency when applications and users are close to the storage region. It does not guarantee sovereignty: a foreign parent, remote administrator or encryption-key service may remain in another jurisdiction. A provider assessment turns these questions into a data residency policy and compliance controls.

The most common gap is an incomplete inventory. Teams map customer records but miss logs, model prompts, file previews and vendor support attachments. Replication can move these copies automatically. A useful control names allowed regions, blocks unapproved replication and tests whether an export and deletion request reaches every copy. The same map supports incident response and a cloud exit.

The GDPR governs personal-data processing and transfers; it does not impose one universal EU storage location. DORA requires financial entities to know where ICT services and data are provided and to maintain contractual access and exit provisions. Sector rules, national secrecy duties or a specific contract can add stricter location terms and shape data residency compliance.

German and Austrian banks apply EU rules under BaFin, ECB or FMA supervision. Swiss banks answer to FINMA and Swiss data-protection law. Cross-border groups often need separate maps because the legal bases differ. Frankfurt data centers serve banks, exchanges and the ECB ecosystem, yet a Frankfurt rack does not settle the legal position of remote support or a non-European provider group.