Learn AI /Data and Infrastructure /Data sovereignty and localisation
Data sovereignty and localisation
- Intermediate
- Data and Infrastructure
- Policy officers
- Managers & front offices
- Human rights practitioners
Also called: data localisation, data residency.
Back to the milestone you came from
In five seconds
What it is
Rules and arrangements about where data is stored, processed and governed, and which laws and authorities apply to it.
In plain words
Ask three separate questions: Where is the data kept? Is it allowed to leave that place? Which laws and authorities can govern it?
An everyday example
You rent a locker and are told that your box will stay in your city. You later learn that the inventory record, security images and backup access logs may be kept elsewhere, while remote support staff can view the account. The box's location resembles data residency. A condition requiring the box and related records to remain within a territory resembles localisation. The laws, regulators and courts that can govern access to the box or its records resemble data sovereignty.
Digital systems are more complex than paper cabinets. Data can be copied instantly, split across several servers, cached temporarily and backed up automatically. A file can be stored in one country, processed in another and accessed remotely from a third. Also, legal questions about sovereignty can depend on the provider, contracts and applicable law, not only on the server's street address.
Remember thisA hosting address answers only part of the question. Check every place data may be stored, processed, copied or accessed, and which legal authorities can reach it.
This term is contested
The boundaries between these terms are not fully settled across laws, vendors and policy communities. 'Data sovereignty' in particular is used in both narrow legal senses and broader political or strategic senses, so authors may define it differently.
Understand it
Understand it
Why it matters
These terms affect legal exposure, procurement, human rights risk, continuity of operations and public trust. A service may be affordable and useful yet still be unsuitable if data crosses borders unexpectedly, falls under an incompatible legal regime or cannot meet local requirements. Leaders need to ask not only 'Does it work?' but also 'Where does the data go, who can lawfully reach it, and what trade-offs follow?'
Residency, localisation and sovereignty: related but different
Help the reader explain how physical location, transfer restrictions and legal authority relate but are not the same thing.
01
Data residency
Focus on physical storage location: which country or region holds the data on servers or backups.
Draw a server icon inside a box labelled 'Region A'. Add caption: 'Main question: Where is it stored?' Include a small backup icon in the same region.
02
Data localisation
Focus on restrictions or requirements: must the data stay in one place, or can it move elsewhere under conditions?
Draw arrows from Region A to Region B, with one blocked by a red stop symbol and one allowed with a checklist icon. Caption: 'Main question: May it leave? Under what rules?'
03
Data sovereignty
Focus on legal authority: which laws, courts or regulators may govern access, handling and disclosure?
Place a gavel or law-book icon above Region A and a different one above Region B. Caption: 'Main question: Which legal system applies?'
04
Why they overlap
One system can involve all three at once. Data may be stored locally, prevented from transfer and still involve provider or contract issues that affect legal control.
Add a bottom row showing one example setup: 'Stored in Region A; export limited; provider operates globally.' Connect all three columns to this row with thin lines.
A three-column comparison diagram. Each column names one term and shows the main question it answers, plus a simple example. Read left to right to see the difference between where data sits, whether it may leave and which laws apply.
Hover or tap each column to reveal one short example: residency example, localisation example, sovereignty example, then a combined example.
Describe this without the diagram
This is a three-part comparison. First, data residency asks where data is physically stored, such as on servers in one region. Second, data localisation asks whether rules require the data to remain there or limit transfer to other places. Third, data sovereignty asks which laws and legal authorities apply to that data and its handling. A final note explains that one real system can involve all three at once, but they answer different questions.
With reduced motion: A static three-column table with the same headings, examples and bottom-row overlap example, with no hover effects or animation.
These related terms are about location and control, but they are not identical. Data residency usually means where data is physically stored. Data localisation usually means rules or practices that require data to stay within a country or region, or that limit transfer elsewhere. Data sovereignty usually concerns which laws and legal authorities may apply to data, including because of where it is held or processed, and sometimes also reflects claims about national or community control.
What goes in is data, plus decisions about storage, processing and access. That can include documents, databases, logs and backups. It also includes metadata, which is information about the data, such as where it came from, when it was created and who can access it.
What happens is that an organisation chooses or is required to use certain servers, cloud regions or local infrastructure. It may keep copies in one country, block cross-border transfers, or use a provider that offers regional hosting. Contracts, technical controls and legal rules all matter. If AI is involved, both the training data and the system that runs the model may be affected.
What comes out is a specific operating setup: for example, data stored in Amman, processed in Frankfurt, backed up in São Paulo, or kept only inside one jurisdiction. This can change compliance, speed, cost, resilience and who can lawfully request access. It does not automatically guarantee privacy, security or ethical use, which are related but different questions.
How “A box in commercial storage” maps onto the real thing
| In the story | In the AI system |
|---|---|
| The cabinet's physical office location | Data residency: where data is stored |
| The rule that files must stay in one office or country | Data localisation: restrictions requiring local storage or processing |
| The law governing who may access the files | Data sovereignty: which legal authority applies |
| Sending only selected copies to another office | Controlled cross-border data transfer or regional processing |
A worked example
A programme officer at a regional bureau reviews bids for an AI-assisted search service covering public guidance and restricted internal background notes.
Starting from: The vendors describe regional hosting, remote technical support, replicated backups and several subcontractors, but use different definitions of where processing occurs.
- The procurement unit asks each vendor to map storage, indexing, inference, logging, support access, replication and backup locations separately.
- The programme officer classifies the public and restricted collections and records the transfer and access conditions that apply to each.
- The bidders must identify every subcontractor and jurisdiction that could receive the data or compel its disclosure, rather than naming only the primary data centre.
- The contract requires approved processing locations, controlled cross-border transfers, equivalent backup arrangements and evidence that deletion covers replicas and logs.
Result: The evaluation distinguishes data residency from localisation and sovereignty. A bid is not treated as compliant merely because its main data centre is regional if processing, support access or backups can occur elsewhere under different legal authority.
In a United Nations workplace
At a small field presence with unreliable connectivity, a reporting officer receives an implementing partner's progress report and is asked to upload it to a cloud service that can summarise submissions before close of business.
The officer needs to establish where the report, prompts, generated summary, logs, replicas and backups would be stored and processed. Declared regional hosting does not by itself show whether remote support, subcontractors or cross-border transfers bring other jurisdictions into play.
Before you try thisDo not upload a report containing personal, protection-related, security-sensitive or other confidential information to a service that has not been approved for it. Redaction is not sufficient if identities can be inferred. Confirm authorised access, processing locations, transfers, retention, deletion and applicable legal requirements before any upload.
Where you may hear it
- A vendor demo during a procurement meeting
- Clearance of terms of reference for a cloud service
- An ICT governance board reviewing hosting options
- A contract negotiation on backups and remote support
- An inter-agency working group discussing cross-border transfers
Avoid confusion
Avoid confusion
Often confused with
Data governance
Data governance is the set of rules, roles and checks that control how data is collected, stored, used, shared and corrected over time.
Privacy
Privacy means controlling how information about identifiable people is collected, used, shared and kept, so they are not exposed, tracked or harmed unfairly.
Cloud computing
Using on-demand computing services over a network, instead of relying only on machines you manage directly.
Common misconceptions
Common misconception: If data is stored in my country, it is automatically private and secure.
Correction: Local storage does not by itself provide good access controls, encryption, safe logging or responsible use. Privacy and security depend on design, governance and practice, not just geography.
Common misconception: Data residency, localisation and sovereignty all mean the same thing.
Correction: They overlap, but they answer different questions. Residency is about storage location. Localisation is about restrictions on movement or processing. Sovereignty is about which legal authority and laws apply.
Common misconception: Using a local data centre means foreign laws can never affect the data.
Correction: Legal exposure can depend on contracts, provider structure, remote administration, applicable law and government powers, not only on where the server sits. Physical location matters, but it is not the whole picture.
Quick check
Which statement best distinguishes the three related terms?
The key difference is the question each term answers: storage location, movement restrictions and legal authority. They often overlap in one system, but they are not interchangeable.
Go deeper
Go deeper
The simple version
Ask three separate questions: Where is the data kept? Is it allowed to leave that place? Which laws and authorities can govern it?
The technical version
Data residency concerns the physical or declared hosting location of data at rest, including replicas and backups. Data localisation concerns policy, legal or contractual constraints that require local storage, local processing or controlled cross-border transfer. Data sovereignty concerns the jurisdictional framework governing collection, access, disclosure and processing, including which state's laws, regulators or courts may apply. In practice, cloud architectures complicate this because data may be sharded, cached, mirrored or remotely administered across regions, while logs, model telemetry and support workflows create additional data flows. For AI systems, the relevant scope may include training data, prompts, outputs, fine-tuning sets, inference logs and model-hosting infrastructure.
Reviewed external resources
Primary sourceAI Risk Management Framework (opens in a new tab)NIST
This link gives a risk-management lens for assessing systems, including governance and operational questions relevant to where data is handled, and suits managers and technical leads.
Intermediatelink checked 2026-07-31
Primary sourceOECD AI Principles (opens in a new tab)OECD
This link gives high-level principles for trustworthy AI governance across contexts, and suits policy and leadership readers.
Intermediatelink checked 2026-07-31
EncyclopaediaData sovereignty (opens in a new tab)Wikipedia
This link gives a broad introductory overview of the term and related ideas, and suits readers who want a quick starting point before deeper policy material.
Intermediatelink checked 2026-07-31
VideoVideo explanations: Data sovereignty and localisation (opens in a new tab)YouTube search
This search-results page helps readers find a range of video explanations with different levels of depth, and suits people who prefer audiovisual learning and comparison.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: Data sovereignty and localisation (opens in a new tab)Reddit search
This search-results page helps readers sample community questions, examples and disagreements about the topic, and suits readers who want informal discussion alongside more formal sources.
search results, not one pagelink checked 2026-07-31
Where this came from
Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.
The one thing to remember
A hosting address answers only part of the question. Check every place data may be stored, processed, copied or accessed, and which legal authorities can reach it.