Data residency
The rule that customer data and its copies must stay in a named country or region, such as the EU.
What it is
Data residency is a rule or promise about the geographic region where data is stored, and sometimes where it may be processed. A customer may require EU-only storage, for example, even when the law would permit a properly protected transfer elsewhere. Residency is about location; data sovereignty is about which country's laws can reach the data, and data localization is the stricter rule that keeps a copy or the whole workload inside a country.
Reach for a residency design when a contract, regulator, or procurement team names an allowed region. Map every copy of the data, then pin databases, object storage, search indexes, queues, backups, and disaster recovery to approved regions. Record whether support staff and subprocessors outside those regions may access it.
Gotcha: choosing an AWS or Azure region does not settle residency by itself. Logs can flow to a global security account, backups can replicate across borders, and support exports can land on a laptop. The boundary has to cover the boring copies too, not just the primary database.
Ask AI for it
Create an EU-only data-residency architecture for the AWS workload described below. Inventory every data store and copy, including Amazon S3, Amazon RDS, OpenSearch, CloudWatch Logs, queues, caches, backups, support exports, and disaster recovery. For each one, name the AWS Region, replication setting, encryption key location, retention period, subprocessor access path, and control that prevents transfer outside the EU. Include AWS Organizations service control policies and AWS Config rules that deny unapproved Regions, a data-flow diagram, a migration plan for existing out-of-region copies, and a quarterly evidence checklist. Flag any AWS service whose control plane or support path cannot meet the boundary.