Data Localization

Everything you do on the internet leaves information behind: your name, your messages, your orders. This information doesn’t sit on your phone, but on large computers in warehouses, so-called data centers. Such halls exist all over the world, often far away from the user. Data localization means: A state mandates by law that certain information about its residents may only be stored on computers within its own country. Some rules are strict and prohibit any transfer abroad. Others merely require that an additional copy remain domestically.

Why states want their data kept in their own country

The most important reason is the question of which law applies. If a computer is located in the USA, American authorities can, under certain conditions, access the stored information. A German court has little say over that. Whoever brings storage back into their own country also regains control.

Then there are economic motives. A new data center often costs several hundred million euros and creates jobs in construction and operation. Governments see this as an investment that would otherwise have taken place abroad. Some countries therefore deliberately link the regulation to industrial policy.

Critics counter that borders on the net don’t automatically increase security. A poorly protected server domestically is more dangerous than a well-protected one abroad. Moreover, authoritarian states like to invoke data localization to facilitate surveillance. If the data is located within the country, the domestic police can access it at any time.

What companies have to build for it

Technically, the requirement usually means separate storage locations per region. A provider then doesn’t operate one global database, but many regional ones. When an account is created, it’s determined which region each user belongs to. From then on, their profile, their messages, and their payment data only move within that region.

That sounds simpler than it is. Many functions need an overall view across all users, such as detecting fraud or stolen accounts. Such systems must be rebuilt to work with separated pools of data. Training AI models also becomes more difficult, because the training data can no longer converge in one place.

It’s important to distinguish this from data protection. Data protection regulates what may be done with information. Data localization only regulates where it is physically located. The two often intertwine, but they are not the same thing. A common misconception is that data stored domestically is automatically better protected. Location alone says nothing about encryption or access rights.

From the GDPR to India’s payment data

In Europe, the best-known case is the General Data Protection Regulation, or GDPR for short. It prohibits transfers to countries without a comparable level of protection. That’s why providers like Microsoft or Amazon now explicitly offer European storage locations. Russia and China go further and require domestic storage without exception.

Since 2018, India has mandated that payment data remain within the country. Credit card companies therefore had to build their own systems, or else they would no longer have been allowed to issue new cards. Such conflicts regularly appear in business news.

You’ll also encounter the term when purchasing cloud services. Companies and government agencies specifically ask providers in which country their data is located. The English term for this is Data Residency. For schools, hospitals, and public authorities, this question is often decisive when choosing a provider.