.svg){kind=logo}
Most teams ask which countries have data residency laws. The question that actually decides your architecture is narrower: which rules force this data, held by this kind of company, to stay in this country, and which only ask for a safeguard when it leaves?
Only a minority of countries require personal data to be stored in-country across the board, and Russia is the clearest case. Most use narrower rules: critical infrastructure operators in China, payment data in India, banks in Indonesia, health data in the UAE. The EU, the US, Australia and Brazil have no general storage mandate.
Quick answer
Data residency laws by country fall into three classes: strict (a general in-country storage rule), conditional (storage rules for named operators, sectors or data types) and none (transfer or accountability duties only). In the 12 markets below, one is strict, six are conditional, and five have no general mandate (Canada, Australia and the US keep narrow exceptions).
This page is about where data must be physically stored. It is not a guide to the privacy rights a country grants, which is what our map of data privacy laws by country covers. And it is not the legal toolkit for moving data out (SCCs, adequacy findings, China's export routes), which sits in our guide to cross border data transfer requirements.
By the end, you can sort 12 markets into strict, conditional and none. You will know which ones need an in-country hosting decision before a deal closes, and you will have a short script for the security-questionnaire question. Facts are current as of October 2026, and this is education, not legal advice.
Here's what's ahead:
- Residency, localization and sovereignty: three terms, three different rules
- Why storage law matters when you sell SaaS
- Strict and conditional rules in China and Russia
- Sector and operator rules in India, Indonesia, the UAE, Vietnam and South Korea
- Markets with no storage mandate: the EU, US, Canada, Australia and Brazil
- A 12-market comparison table and a decision path for SaaS startups
GDPR
Selling to EU customers? Start with the framework behind their questions
GDPR is one of the 25+ frameworks ComplyJet supports, alongside ISO 27701. See how compliance automation covers it for an early-stage team.
Data Residency vs Data Localization vs Data Sovereignty: Three Terms, Three Different Rules
These three words get used as synonyms, and the mix-up causes real contract errors. Each one answers a different question.
- Data residency is where data is physically stored. It is usually a choice or a contract promise: "we host your data in Frankfurt."
- Data localization is a legal requirement that data be stored, or processed, inside a country. It is a law you obey, not a feature you offer.
- Data sovereignty is the question of which country's law and courts can reach the data, wherever it sits.
The difference between data residency and data localization matters in a contract. Residency is a promise you make, localization is a law you obey, and sovereignty is a risk you disclose. A vendor can satisfy one and fail another: data stored in Frankfurt but run by a US parent that a US court can compel is resident in Germany and still exposed to US legal process.
Quick take
A country can have strong data sovereignty ambitions and no localization law at all. Storing data in-country does not, by itself, keep foreign law out.
Data Residency Laws by Country Fall Into Three Classes
I use three labels throughout this page, so the rest of it reads faster.
| Class | What it means | What it means for a SaaS startup |
|---|---|---|
| Strict | A general rule that a broad category of personal data must be stored in-country | Plan local storage before you collect that data |
| Conditional | In-country storage for named operators, sectors or data types | Find out whether your customer's industry or the data type triggers it |
| None | No storage mandate; transfer rules or accountability duties instead | A documented answer is enough, hosting is a sales choice |
Data Localization Laws vs Cross Border Transfer Rules: Where This Page Stops
Localization says where data lives. Transfer rules say what must be true when it leaves. A perfect set of standard contractual clauses does not satisfy a rule that data must stay home, and an in-country database does not answer a rule about onward transfers.
For the transfer side, including adequacy and China's export routes, read our guide to cross border data transfer requirements. Here, China and India appear only for their storage rules.
Why Data Residency Laws by Country Matter When You Sell SaaS
The residency question usually arrives as one line in a vendor security questionnaire: "Where is customer data stored?" The honest answer depends on the buyer's industry, not on where your company is incorporated.
Residency shows up for a SaaS vendor in three places:
- The law: a mandate on the customer's industry, or on you directly.
- The contract: a promise to host in a named region.
- The questionnaire: questions about primary storage, backups, support access and sub-processors.
A rule that binds your customer's industry can flow down to you even when it does not bind you directly. India's central bank, for example, requires payment system providers to store payment data only in India. A vendor that handles that data for such a provider inherits the requirement through the contract.
Watch out
"We host on a US cloud region" answers the primary-storage question. It does not answer the backup, logging or support-access question, and that is where residency promises quietly break.
Try this yourself
Ask your cloud provider and your top three sub-processors where backups, logs and support tooling physically sit. Record each answer with the date. If an answer is "it depends," that is the line a buyer will ask about next.
Strict and Conditional Data Localization Laws: China and Russia
These are the two markets where data residency laws by country are general enough that a SaaS vendor with local users has to plan for them. The rest of the map is narrower, and China data localization is narrower than most summaries suggest.
Data Residency Laws by Country: China Data Localization for Critical Infrastructure Operators
Law and year: the Cybersecurity Law (adopted in 2016, in force from 2017, amended on 28 October 2025 with effect from 1 January 2026), alongside the Personal Information Protection Law and the Data Security Law of 2021.
Who it applies to: operators of critical information infrastructure. Under the amended text, personal information and important data they collect or generate during operations in China must be stored in China, and if they truly need to provide it abroad, a security assessment applies. That is Article 39 in the October 2025 English translation published by Georgetown's CSET, and it sat at Article 37 before the amendment renumbered the law.
What about everyone else? The Cyberspace Administration's March 2024 provisions regulate how data leaves China (security assessment, standard contract or certification, depending on volume) and set no general localization requirement. Those export routes are explained in our cross border data transfer requirements guide.
Class: conditional.
Penalties: the amended law does not set a storage-specific fine in its own text. It sends violations of the storage rule to the penalty provisions of other laws, so I do not quote a figure here.
Practical effect for a SaaS startup: the question is whether a customer is a critical information infrastructure operator or holds important data. A startup selling to ordinary Chinese businesses faces export-route rules, not a storage mandate.
In China the storage duty follows the customer's status, so ask who the customer is before you ask where to host.
Data Residency Laws by Country: Russia Data Localization Law and the 242-FZ Fines
Law and year: Federal Law 242-FZ amended the personal data law and took effect on 1 September 2015. Federal Law 405-FZ made a breach an administrative offence from 13 December 2019.
Who it applies to: operators, Russian or foreign, that collect personal data of Russian citizens. They must first record, systematize, accumulate, store, update and retrieve that data in databases located in Russia.
Class: strict.
Foreign copies: a 2015 Duane Morris alert, summarising the Ministry of Communications guidance of August 2015, reads the rule as allowing a secondary copy abroad (a backup, for example) once the primary Russian database exists, provided the foreign copy holds nothing the Russian one lacks. The guidance is a decade old, so treat it as a starting point for counsel, not a safe harbour.
Penalties: up to RUB 6,000,000 for a legal entity on a first offence and up to RUB 18,000,000 on a repeat offence, according to a January 2020 analysis in Hunton Andrews Kurth's Privacy World blog. LinkedIn was blocked in Russia in 2016 over this rule, per a 2021 Morgan Lewis practice note.
Practical effect for a SaaS startup: the Russia data localization law applies once you collect data from Russian citizens through an online service, so the rule becomes yours. A global cloud region does not answer it by itself.
Russia is the clearest strict case in this set, and the only one where plain hosting in another country fails the rule from day one.
Watch out
Federal Law 420-FZ, in force since 30 May 2025, raised penalties for personal data leaks and repeat leaks. It is a breach-penalty law, not a localization penalty, so do not cite it as one.
Data Residency Requirements by Sector and Operator: India, Indonesia, UAE, Vietnam and South Korea
In these five markets there is no blanket rule, which is exactly why vendors get caught. The data residency requirements attach to the customer's industry or to a named type of operator.
Data Residency Laws by Country: India Data Localization, RBI Payment Data and the DPDP Act
Sector rule in force today: the Reserve Bank of India's circular RBI/2017-18/153 of 6 April 2018 requires payment system providers to store the entire data for their payment systems "in a system only in India." The foreign leg of a transaction may also be stored abroad. Providers had six months to comply and report to the RBI.
General law: the Digital Personal Data Protection Act 2023 allows transfers outside India except to countries the Central Government restricts. The DPDP Rules were notified on 13 November 2025, and a K&S Partners analysis reports that no restricted country list has been published, that there is no blanket localization requirement, and that significant data fiduciaries may face limits on transferring specified data categories. The operational provisions phase in roughly 18 months after notification.
Class: conditional. Payments are strictly local today. Everything else is open by default on paper.
Practical effect for a SaaS startup: India data localization bites only where a vendor processes payment data for an Indian payment system provider inherits the in-India requirement by contract. One that does not is outside it, for now.
Myth debunking
"India requires all personal data to stay in India." NO. There is no general rule. The RBI payments mandate is the sector rule that exists today, and the DPDP Act uses a restricted-country model instead of a storage mandate.
India is free by default under the DPDP Act and strictly local for payment data today.
Data Residency Laws by Country: Indonesia, Public Operators, Banks and Insurers
Law and year: Government Regulation 71 of 2019, issued in October 2019, splits electronic system operators into public and private. Public operators must place their systems and data in Indonesia, with a transition that ended in October 2021. Private operators may host offshore, but must give Indonesian authorities access for supervision and law enforcement.
Financial sector: GR 71 leaves banks and insurers to their own regulator. OJK Regulation 38/POJK.03/2016 (as amended by 13/POJK.03/2020) covers general banks, and OJK Regulation 69/POJK.05/2016 (as amended by 38/POJK.05/2020) covers insurers. Only certain systems and data of those institutions may be processed or stored offshore, and offshore arrangements need prior OJK approval.
A Herbert Smith Freehills Kramer note published in October 2020 describes these rules. A September 2025 Rouse overview still frames the position the same way: local storage for public sector data, offshore storage for private companies under oversight, stricter rules for banks.
Class: conditional.
A private SaaS vendor is outside the strict rule, and a bank's vendor is not.
UAE Health Data Law: Federal Law No. 2 of 2019 and Ministerial Resolution 51/2021
Law and year: Federal Law No. 2 of 2019 on the use of ICT in health fields. Article 13 bars storing, processing, generating or transferring health data relating to health services provided in the UAE outside the country, unless an exception applies. Ministerial Resolution 51/2021 lists ten of them.
Who it applies to: healthcare providers and anyone handling that health data, including free zones. DIFC and ADGM entities must also meet their own data protection laws, according to a Hogan Lovells analysis of the Resolution.
The ten exceptions cover medical treatment abroad, samples sent to overseas laboratories, approved scientific research, insurance coverage and claims, cooperation with UAE government bodies, simple unsupervised wearables, pharmacovigilance, other data a facility approves, telemedicine and a patient's formal request. Several carry conditions: specific written patient consent, sharing only what the case requires, encryption, and in some cases keeping copies of the data and the consent in the UAE.
Class: conditional (health data).
Practical effect for a SaaS startup: under the UAE health data law, a healthtech tool holding UAE patient data needs an exception or in-country hosting. A general business tool does not touch this law.
Quick take
A customer asking whether health data can be stored outside the UAE should hear: not by default, here are the ten exceptions, and the one that applies is documented.
The UAE rule follows the data type, not the vendor.
Data Residency Laws by Country: Vietnam Decree 53/2022 and the Five-Condition Trigger
Law and year: the Law on Cybersecurity 2018 and Decree 53/2022, in force from 1 October 2022. Domestic enterprises providing listed telecom, internet and online services in Vietnam must store specified user data locally. Foreign enterprises are caught only if all five conditions are met, ending in a written order from the Minister of Public Security.
If that order arrives, a foreign enterprise has 12 months to comply, must keep the data for at least 24 months and must keep a local branch or representative office, according to an Allens analysis from August 2022. A September 2025 Rouse overview describes the same trigger.
Status check: a Duane Morris note says the Law on Cybersecurity 2025 applies from 1 July 2026, that the data localization requirement remains, and that a government decree is expected to detail it. I could not confirm which implementing decree governs now, so confirm the current instrument with Vietnamese counsel before relying on Decree 53's specifics.
Class: conditional.
For a foreign SaaS vendor the Vietnam rule is a trigger, not a standing duty.
Data Residency Laws by Country: South Korea and Its Sector and Public-Sector Rules
Law and year: the Personal Information Protection Act has no general localization rule, according to the 2025 Chambers Data Protection guide. Individual laws restrict specific data instead.
- Medical Services Act: prohibits storing electronic medical records outside Korea.
- Spatial data law: a licence is needed to transfer certain map data abroad.
- Electronic Financial Transactions Act: financial companies using cloud services cannot locate systems that process unique identification or personal credit information outside Korea.
- Cloud Computing Act: data processed by Korean government bodies and public institutions must be located in Korea.
Class: none general, conditional by sector.
Practical effect for a SaaS startup: nothing general, but a vendor to a Korean hospital, bank or public agency meets a hard rule through that customer.
Korea has nothing general, and the sector exceptions are the ones that matter.
ComplyJet customers
What buyers ask a small vendor to prove
Narad automates security questionnaire responses for enterprises, and its own prospects asked whether a compliance company is compliant itself. It reached a SOC 2 Type 2 report and later added GDPR. The story is about proving your own posture, the same job a data-location answer does.
Countries Without a General Storage Mandate: EU, US, Canada, Australia and Brazil
For a startup, half of the data residency laws by country amount to "no rule," and the most common error is mistaking a transfer rule for a storage rule. These five markets show the difference, starting with GDPR data residency.
GDPR Data Residency: Why the EU Does Not Require Data to Stay in the EU
Law and year: GDPR regulates transfers out of the EU (Chapter V), not where data is stored. The European Commission states that every organisation should be able to store and process data anywhere in the EU, and that the Free Flow of Non-Personal Data Regulation (Regulation (EU) 2018/1807) complements GDPR so that together they cover all data. That Regulation addresses non-personal data.
Class: none.
Practical effect for a SaaS startup: choosing an EU region is a customer-trust and contract decision, not a statutory duty. A US-hosted vendor can serve EU customers with a lawful transfer mechanism, which is covered in our cross border data transfer requirements guide and in our piece on GDPR for US companies.
Myth debunking
"GDPR requires EU customers' data to stay in the EU." NO. It requires a lawful transfer mechanism when data leaves. Sector and public-sector rules in individual member states were not surveyed for this page, so a public-sector buyer can still impose its own location terms.
EU residency is a sales feature, not a statute.
United States: No General Mandate, but Federal Contracts and the DOJ Rule Matter
Law and year: I found no general federal data localization statute in the sources reviewed, and state laws were not surveyed. Two federal items matter for SaaS vendors.
First, federal cloud work. FedRAMP's own help center says agencies can write data-location requirements, such as continental-US-only, into a solicitation. A location term in a federal contract is a contract duty, not a statute.
Second, the Department of Justice's Data Security Program (28 CFR Part 202). It took effect on 8 April 2025, with due diligence, audit and reporting requirements following in October 2025.
It works like an export control: it limits certain transactions that could give countries of concern (China including Hong Kong and Macau, Cuba, Iran, North Korea, Russia and Venezuela) access to bulk sensitive personal data or US government-related data. It controls access and transactions, not storage. The rule detail sits in the cross border transfer guide linked above.
Class: none general, conditional for federal contracts.
The US restricts who can get at bulk data, not where it sits.
Canada: Federal Accountability, Quebec's Assessment and Nova Scotia's Public-Sector Rule
Law and year: PIPEDA, the federal private-sector law, has no general localization rule. It works through accountability: an organisation stays responsible for personal information a foreign processor handles for it.
Quebec adds a process. Under section 17 of its private-sector privacy act, as amended by Law 25, an organisation must complete a privacy impact assessment before communicating personal information outside Quebec, including granting remote access. The assessment weighs the sensitivity of the data, the purposes, the protective measures and the destination's legal framework, and a written agreement must follow. Since 22 September 2023 organisations must also tell people at collection that their data may leave Quebec, per a BLG analysis.
Nova Scotia is the hard-rule exception. Its Personal Information International Disclosure Protection Act (2006) requires public bodies and their service providers to store and access personal information only in Canada unless an exception applies. IAPP reporting from December 2021 described Nova Scotia as the only Canadian jurisdiction with public-sector data residency rules after British Columbia repealed its own.
Class: none federal, conditional for the provincial public sector.
Canada is an accountability regime with one provincial public-sector exception.
Australia: APP 8 Accountability and the My Health Record Rule
Law and year: the Privacy Act 1988. Australian Privacy Principle 8 requires reasonable steps before disclosing personal information to an overseas recipient, and section 16C makes the disclosing entity accountable for the recipient's acts. The OAIC guidance states no storage-in-Australia requirement, and notes that routing data through overseas servers is usually a "use" rather than a disclosure when the entity keeps effective control.
There is one health-specific exception to know about. The My Health Records Act 2012 contains a section titled "Requirement not to hold or take records outside Australia" (section 77), which relates to records in the My Health Record system. Check its scope with counsel if you build for that system.
Class: none general, conditional for My Health Record.
Australia keeps you accountable wherever the data sits.
Brazil: LGPD Transfer Conditions and ANPD Resolution 19/2024
Law and year: the Lei Geral de Protecao de Dados (Law 13.709/2018). ANPD Resolution 19/2024, published on 23 August 2024, sets the rules for international transfers and approves standard contractual clauses that must be adopted in full. The routes include ANPD adequacy decisions, contractual clauses and global corporate rules, and each transfer also needs a legal basis under the LGPD.
I found no general localization requirement in the LGPD or the Resolution. They regulate how data leaves Brazil, not where it starts. Mechanism detail is in the cross border transfer guide linked earlier.
Class: none.
Brazil regulates how data leaves, not where it starts.
Data Residency Laws by Country: The 12-Market Comparison Table
Here is the same information on data residency requirements in one place, grouped by class.
| Country | Law and year | Who it applies to | What must stay | Class | First action for a SaaS vendor |
|---|---|---|---|---|---|
| Russia | 242-FZ (2015), 405-FZ (2019) | Operators collecting Russian citizens' data | Primary database for that data | Strict | Plan local primary storage before collecting |
| China | Cybersecurity Law (amended 2025), PIPL, DSL | Critical information infrastructure operators | Personal information and important data they collect or generate | Conditional | Ask whether the customer is an operator |
| India | RBI circular (2018), DPDP Act (2023), Rules (2025) | Payment system providers; all fiduciaries for transfers | Payment system data; nothing else by default | Conditional | Check if you touch payment data |
| Vietnam | Cybersecurity Law (2018, replaced 2026), Decree 53 (2022) | Listed online services; foreign firms after a ministerial order | Specified user data | Conditional | Confirm the current decree with counsel |
| Indonesia | GR 71 (2019), OJK rules | Public operators, banks, insurers | Public-sector systems and data; most bank and insurer data | Conditional | Ask if the customer is public or a bank |
| UAE | Federal Law 2 (2019), Resolution 51 (2021) | Health data for UAE health services | Health data, unless an exception applies | Conditional | Identify the exception or host locally |
| South Korea | PIPA; medical, finance, spatial, cloud laws | Hospitals, financial firms, public bodies | Medical records, certain financial and public-sector data | Conditional | Ask the customer's sector first |
| Canada | PIPEDA; Quebec Law 25; Nova Scotia Act (2006) | Private sector; Nova Scotia public bodies | Nothing federal; public-body data in Nova Scotia | None federal | Document Quebec assessments |
| Australia | Privacy Act (APP 8); My Health Records Act (2012) | All APP entities; My Health Record data | Nothing general | None general | Keep overseas contracts APP 8-ready |
| United States | No general statute found; DOJ rule (2025) | Federal contracts; bulk data deals with countries of concern | Nothing general | None general | Read federal contract location terms |
| EU/EEA | GDPR; Regulation (EU) 2018/1807 | All controllers and processors | Nothing | None | Pick a mechanism for transfers |
| Brazil | LGPD (2018); ANPD Resolution 19/2024 | All controllers | Nothing | None | Use ANPD clauses for exports |
Quick take
In this set only Russia is strict across a broad category of personal data. The other mandates attach to operators, sectors or data types, so the customer's industry decides the rule.
The fines that were verified are Russia's (up to RUB 6,000,000 on a first offence and RUB 18,000,000 on a repeat) and nothing else with a storage-specific figure. The other rows have no verified storage-specific fine, so none is shown. Treat statutory ceilings as ceilings, not as a record of what regulators have actually done.
Data Residency for SaaS: A Decision Path for Startups
A startup does not need a data center in every market. Data residency for SaaS comes down to knowing which markets make hosting a legal duty and which only make it a sales question.
Data Residency Laws by Country: Which Markets Need In-Country Hosting
Read the list in this order, because the first match wins.
- Russia: if you collect data from Russian citizens, plan local primary storage first.
- China: only if the customer is a critical information infrastructure operator or holds important data.
- India: only for payment system data.
- UAE: only for health data without an applicable exception.
- Indonesia and Vietnam: only when the customer sits in a public or banking context, or after a government order.
- South Korea: only for medical, financial and public-sector customers.
- Everywhere else: a contract and questionnaire answer, not a hosting duty.
So choose in-country hosting if you meet one of the first six conditions. Choose a documented regional option if a buyer asks for one and no law does. Otherwise, publish one accurate data-location statement and keep it current.
What Enterprise Buyers Ask in Security Questionnaires About Data Location
Four questions recur, and each has a one-line answer if you have done the work.
- Where is primary data stored? Name the cloud, the region and the date you checked it.
- Where are backups and logs stored? Name the same, because this is the question that most often breaks a residency promise.
- Who can access data from another country? Name the support and engineering locations.
- Which sub-processors hold copies, and where? Point to your sub-processor list with countries.
The vendor-side review that sits behind these answers is covered in our third-party risk management policy guide.
Try this yourself
Write your data-location statement as one paragraph, then have an engineer check each line against the cloud console rather than against memory. Any line that cannot be checked in the console comes out.
Building a Data-Location Record Before a Customer Asks
A data-location record is a short document you can hand over in a day. It holds:
- A map of data types and where each is stored.
- Backup and log locations.
- A sub-processor list with the countries involved.
- A named owner and a review date.
This ties directly to the record of processing in ISO 27701 and to your data retention policy, because how long data stays matters wherever it is stored.
Mistakes to Avoid With Data Residency Laws by Country
These are easy to get wrong when you read data residency laws by country quickly, and each one can cost a team a deal or a rewrite.
- Treating a transfer mechanism as a localization answer. Signed clauses do not satisfy a rule that data must stay in-country.
- Assuming GDPR requires EU hosting. It regulates transfers, and the Commission says non-personal data can be stored anywhere in the EU.
- Assuming India requires all data to stay in India. The mandate is for payment system data, and the general law uses a restricted-country model.
- Answering primary storage and forgetting backups, logs and support access. The promise breaks in the places nobody checked.
- Relying on an old guide for China, India or Vietnam. All three changed in 2025 or 2026, so check the date of every source.
- Letting the vendor's home country decide the rule. The customer's industry and the data's origin decide it.
Watch out
A residency promise in a contract is a legal commitment of its own, even where no law requires it. Write it only after someone has verified it.
How ComplyJet Fits When a Customer Asks Where the Data Lives
We are a compliance automation platform for SOC 2, ISO 27001, ISO 27701, GDPR and 25+ other frameworks, with a Trust Center. We help keep the evidence behind a data-location statement: policies, a vendor and sub-processor inventory, cloud-provider integrations and access controls.
There are limits, and they are worth stating. We do not host customer data, provide in-country storage or act as a data residency service. We do not give legal advice on any country's law, and we do not map to China, India, Russia, Vietnam or other non-GDPR localization regimes. For the legal call, talk to local counsel.
For teams selling into the EU, the transfer side is covered in the guides linked above.
Book a demo
Bring your last security questionnaire
We will talk through which frameworks to tackle first for a team your size, and where documented evidence helps with buyer questions.
FAQs
Does GDPR require data to be stored in the EU?
No. GDPR regulates transfers of personal data out of the EU, not where data is stored, so a vendor hosted outside the EU can serve EU customers with a lawful transfer mechanism. Choosing an EU region is a trust and contract decision. The mechanisms are covered in the cross border transfer guide linked above.
What is the difference between data residency and data localization?
Data residency is where data is physically stored, usually by choice or contract. Data localization is a legal requirement that data be stored or processed inside a country. A vendor can offer residency without any law requiring it, and a law can require localization whether or not the vendor offers a region.
Which countries require data localization?
In the 12 markets reviewed, Russia is the only one with a general rule for personal data of its citizens. China, India, Vietnam, Indonesia, the UAE and South Korea require it for named operators, sectors or data types. The EU, US, Canada, Australia and Brazil have no general storage mandate, though Nova Scotia's public sector and some health and federal contexts add exceptions.
Do SaaS companies need local hosting to sell in China?
Not by default. The storage requirement attaches to critical information infrastructure operators and to important data, so the first question is who the customer is. A SaaS vendor selling to ordinary businesses faces the export rules for data leaving China instead, which are explained in our guide to cross border data transfer requirements.
Is data localization required in India?
There is no general requirement. The Reserve Bank of India requires payment system providers to store payment data only in India, with the foreign leg of a transaction also allowed abroad. The DPDP Act allows transfers except to countries the government restricts, and no list had been published when the commentary I reviewed was written.
Does the US have data localization laws?
I found no general federal localization statute. Federal contracts can carry location terms, such as continental-US-only for FedRAMP cloud work, and the Department of Justice's 2025 data security rule limits bulk data transactions with six countries of concern. Neither is a general storage mandate.
What is data sovereignty?
Data sovereignty is the question of which country's law and courts can reach data, wherever it is stored. It differs from residency (where the data sits) and localization (a law requiring it to sit somewhere). Storing data in a country does not by itself keep foreign legal demands out.
Can health data be stored outside the UAE?
Not by default. Federal Law No. 2 of 2019 bars storing or transferring health data about UAE health services outside the UAE, and Ministerial Resolution 51/2021 lists ten exceptions, such as treatment abroad, approved research and insurance claims. Several exceptions need written patient consent and encryption, so the exception you rely on should be documented.
Related Reading
- Cross Border Data Transfer Requirements: the legal mechanisms for moving data out, the companion to this page.
- Data Privacy Laws by Country: the wider privacy-law map.
- GDPR Countries: EU and EEA member lists and the adequacy explainer.
- HIPAA Equivalent Laws by Country: health-data law outside the US.
- Third-Party Risk Management Policy: vendor-side review of sub-processors.
- Data Retention Policy: how long the data stays wherever it is stored.
