What does data residency mean?
Data residency is the physical place where data is stored: a country, or a cloud region such as a data center in a given city. When you use cloud software, your records sit on servers somewhere, and a vendor can tell you where.
It sounds technical, but it affects real decisions: which laws apply, who can ask for access, and how safe people are if records are seized or leaked.
A common mistake is to ask only about the main database. Data also sits in backups, in file storage, in logs, in email notifications and in tools the vendor uses to run the service. A full answer covers all of these, or says clearly which ones it cannot cover.
How is it different from sovereignty and transfer?
Three terms often get mixed up.
| Term | Plain meaning |
|---|---|
| Residency | Where the data is stored |
| Sovereignty | Which country’s law and authorities apply to the data |
| Transfer | Moving data from one country to another, including remote access from abroad |
Data can sit in one country and still be reachable under the law of another, for example through the vendor’s home country. And a person in another country who views the data from a laptop may count as a transfer under some laws.
Why does it matter to NGOs?
- Law. Some countries limit where personal data may be stored or sent. Others allow transfers if safeguards exist. Rules differ and change.
- Donors. A grant agreement may name allowed regions or require approval for transfers.
- Partners and authorities. Local partners may be uncomfortable with data stored abroad. In some places, data held locally is easier for authorities to demand.
- Risk to people. For records about displaced people, survivors or minorities, location can change who might reach them.
Because the right answer depends on your context, ask a qualified adviser before you decide.
A simple example: a country office with three field sites holds beneficiary lists. The national law allows storage abroad only with safeguards, and one donor asks for written approval of any transfer. The office needs the adviser’s view on the law and a letter from the donor. Neither is a technical question, yet both depend on the vendor’s answer about region.
Residency is only one part of security. A well-run service in a distant region can be safer than a badly run server in your own country. Use residency as one test among several, and weigh it against the real risk to the people in your data.
What should you ask a vendor?
- Which country and cloud region store the primary data?
- Where are backups stored?
- Can we choose the region? Is that choice fixed per organization?
- Can the vendor’s staff access data from other countries, and under what controls?
- Which other providers process our data, and where? Include AI providers.
- What do the contract and the data processing agreement say about transfers? See our article on data processing agreements.
- If you change region later, how are data and backups moved or deleted?
Ask about support, too. If a vendor engineer helps you from another country and can view your records during that help, the law may treat that as a transfer, even though the data never moves.
Ask for written answers. A statement such as “hosted in region X” is more useful than “stored securely in the cloud”.
What if the region does not match your rules?
You have a few options, in order of simplicity:
- Confirm the rule. Check whether it really bans the region, or allows it with safeguards.
- Reduce the data. Keep the most sensitive fields out of the system, or use codes instead of names.
- Get approval. Ask the donor or partner in writing, and keep the reply.
- Choose another tool. If none of these work, residency is a valid reason to reject a vendor.
Record the decision and its reason, the date and who approved it. If the vendor changes its hosting later, your record shows what you agreed and lets you check again. Our article on questions to ask about cloud security gives the wider list to use alongside this one.
Where EMPOBase fits
EMPOBase is hosted on Google Cloud in the Singapore region. The region is not selectable per organization today, so if your law or donor requires storage elsewhere, talk to us before you commit. Some AI features can send prompts and chosen context to an AI provider, and you can use your own supported AI provider key instead; review the provider and its terms before you send sensitive information. A DPA is available on request, and the security page lists current controls and limits.