Data Residency
Data residency is the requirement — imposed by law, regulation, contract, or policy — that data be stored, processed, or accessed only within specified geographic or jurisdictional boundaries.
Full definition
Drivers include GDPR international-transfer rules, the EU-US Data Privacy Framework, China's PIPL, schmes like FedRAMP, and sector-specific rules (health, finance). For AI systems, residency constrains: where prompts and responses can be sent, where vector stores live, where training data resides, and which model endpoints can be used. Major AI vendors offer regional endpoints (Azure OpenAI per-region, Anthropic on AWS Bedrock per-region, Vertex AI dual-region) to meet these constraints.
Why it matters
Data residency is the most common reason "just call the API" architectures fail in regulated industries. It dictates cloud region selection, which model versions are available, and whether self-hosting is required — sometimes adding 30-60% to the AI infrastructure budget.
Example
A German bank requires all customer data and AI inference inside the EU; the team uses Azure OpenAI in Frankfurt with a Private Link, plus a self-hosted Qdrant cluster, accepting a 25% cost premium over multi-region serving.
Related terms
- EU AI ActThe EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025 and full general-purpose AI rules applying from August 2025.
- AI GovernanceAI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
- AI Total Cost of Ownership (TCO)AI Total Cost of Ownership (TCO) is the total cost of an AI system over its full lifecycle — including model and inference costs, infrastructure, integration, data preparation, governance, monitoring, retraining, talent, and exit costs — usually expressed as 3-year fully loaded.
- Differential PrivacyDifferential privacy is a mathematical framework that bounds how much any single individual's data can influence the output of an analysis or trained model — providing a quantifiable privacy guarantee (epsilon) rather than relying on after-the-fact anonymization.
Source & further reading
Primary source: European Data Protection Board — "Guidelines 05/2021 on Interplay between Application of Article 3 and Provisions on International Transfers" (2021).
Citation policy: this entry is part of the AIDOLS AI Implementation Glossary and may be quoted for research, journalism, and education with attribution to aidolsgroup.com/en/glossary/data-residency/.