AI governance and data protection
What is data residency? Definition and examples
Also: Regional processing
In short
Data residency defines in which region data is stored and processed, for example only in Switzerland or the EU. It governs location, not automatically access: data in Europe can still be reachable for support teams or authorities in other countries.
Why it matters: You can tell customers and authorities clearly where their data is and who can access it.
Location
Where data is stored and processed
Access
Who can reach it, and from where
Why does Data residency matter for your company?
Many customers in Switzerland and Germany require their data to stay in Europe. Data protection laws only allow transfers abroad where adequate protection exists or extra safeguards are agreed: in the EU under the GDPR, in Switzerland under the revFADP.
Location and access are two separate questions. A data centre in Frankfurt or Zurich helps little if support, operations or the parent company can access it from another jurisdiction. Clarify both, and with AI providers also ask where the model itself runs.
Example: Stored in the EU, processed in the US
An AI tool advertises storage in the EU. The security review shows: the documents sit in Frankfurt, but model requests run through data centres in the US. For your Strategy 2027 with its focus on DACH mid-market customers that is a problem, because these are exactly the customers who ask.
The company requires regional processing for both storage and model calls and settles access from third countries in the contract. In customer conversations there is now a clear answer on location and access.
3 common mistakes to avoid
Confusing storage with processing
Data can sit in Europe and still be processed elsewhere. Ask about both.
Forgetting access
Location says nothing about who can access the data. Support and the parent company belong in the review.
Overlooking backups and logs
Copies in backups, logs or monitoring often sit in other regions. They count just as much.
Step by step
- 1
Clarify the requirements
Check what customers, contracts and laws require about where data is held.
- 2
Trace the data flows
Record where data is stored, where it is processed and where it is backed up.
- 3
Fix the region in writing
Set the region in the contract or DPA, including sub-processors.
- 4
Govern access
Settle who may access the data from which country and how you will find out.
Where does your company stand on AI?
The AI Readiness Check shows in a few minutes where you stand across the six dimensions of the AI Monitor.
Start the AI Readiness CheckRead on in the PM Lab
Articles that go deeper.
Related terms
- LLM data controls →LLM data controls are the technical and contractual measures that determine what happens to your data in a language model.
- AI governance →AI governance is the set of rules a company uses to decide who may use AI for what, with which data and under whose responsibility.
- Shadow AI →Shadow AI is the use of AI tools the company has neither approved nor knows about, such as personal chatbot accounts used for work data.