Data Residency

Go up to Terms and Definitions

Discussion

Data residency addresses the location of data and metadata, the movement of data and metadata across geographies and jurisdictions, and the protection of data and metadata against unintended access and other location-related risks.

OMG established a Data Residency Working Group in 2015 to explore issues and practices related to how laws and regulations affect data location and migration. OMG describes the working group's goal as creating a roadmap for specifications that model, monitor, and manage data residency. :contentReference[oaicite:0]{index=0}

OMG and the Cloud Standards Customer Council describe data residency challenges as arising when laws and regulations dictate where data transfers, storage, sharing, and protection occur across geographic boundaries. :contentReference[oaicite:1]{index=1}

Data residency differs from data location alone. Data location identifies where data resides. Data residency encompasses the issues, practices, rules, risks, and controls associated with where data resides, where it moves, which jurisdiction governs that movement, and how systems protect data against location-related risks.

Data residency also differs from data sovereignty and data localisation. Data sovereignty focuses on the legal authority that applies to data based on jurisdiction. Data localisation focuses on actions that keep or place data within a specified jurisdiction. Data residency focuses on the location, movement, and protection practices that arise from geographic and jurisdictional constraints.

Data residency semantic content includes:

Data locationMetadata locationGeographic locationJurisdictionCross-border movementData transferData storageData processingData accessLocation-related riskRegulatory constraintPolicy constraintProtection requirementMonitoring requirementGovernance responsibilityTraceability to residency rules and policies

Definition

issues and practices related to the location of data and metadata, the movement of data and metadata across geographies and jurisdictions, and protection against unintended access and other location-related risks

Source

OMG Data Residency Working Group and OMG/Cloud Standards Customer Council Data Residency Challenges material, specialized for use in the FX Demo Reference Architecture.

Note

Data residency does not apply only to data at rest. OMG's definition includes location, movement, geographies, jurisdictions, and protection against location-related risks. Data residency therefore applies to stored, moving, processed, and accessed data, as well as associated metadata, when location or jurisdiction affects the required controls.

Example

An FX reporting node processes trade data for a trade subject to an EU reporting jurisdiction. A data residency rule requires raw counterparty data and validation evidence to remain within an approved EU processing environment. The architecture routes only report evidence to non-EU nodes and records the policy decision, location, jurisdiction, and transfer reason for audit purposes.

In this example, data residency concerns more than the physical storage location. It also governs movement, processing, access, metadata, routing, and protection against location-related risks.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.