Data residency

Data residency is where data is stored and processed, and the jurisdiction whose rules apply to it.

Definitions only — a term explained here is not a service we sell.

Data residency is where data is stored and processed. Where data sits is one factor in which rules apply; establishment, the people concerned and transfer rules also matter, so a cross-border design must name each leg and its legal basis.

Telecom data includes call and message records, location, IP addresses, IMSI and MSISDN, support tickets, backups and logs.

Residency, sovereignty and transfer

Residency asks where data sits. Sovereignty asks whose law applies. Transfer asks how data may legally leave one jurisdiction for another. A design can satisfy one and fail the others.

Transfers usually rest on an adequacy decision, standard contractual clauses, binding corporate rules or a specific derogation, each with conditions. China's PIPL and the EU's GDPR apply different tests. Ask where each store sits, including backups, and where staff can access it. This is general information, not legal advice. The China compliance page covers one region.

FAQ

Is residency the same as localization?

No. Localization is a legal requirement to keep data in a country; residency is a design choice about where it sits.

Do CDRs contain personal data?

Often yes, because they can be linked to a subscriber. Treat message and call records as personal data unless counsel confirms otherwise.

Does encryption settle residency?

No. Encrypted data is still stored somewhere, and the keys have a location too.

Learn more

Sources

  1. EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)