Data Residency

Go up to Terms and Definitions

Data residency addresses the location of data and metadata, the movement of data and metadata across geographies and jurisdictions, and the protection of data and metadata against unintended access and other location-related risks.

OMG established a Data Residency Working Group in 2015 to explore issues and practices related to how laws and regulations affect data location and migration. OMG describes the working group's goal as creating a roadmap for specifications that model, monitor, and manage data residency. :contentReference[oaicite:0]{index=0}

OMG and the Cloud Standards Customer Council describe data residency challenges as arising when laws and regulations dictate where data transfers, storage, sharing, and protection occur across geographic boundaries. :contentReference[oaicite:1]{index=1}

Data residency differs from data location alone. Data location identifies where data resides. Data residency encompasses the issues, practices, rules, risks, and controls associated with where data resides, where it moves, which jurisdiction governs that movement, and how systems protect data against location-related risks.

Data residency also differs from data sovereignty and data localisation. Data sovereignty focuses on the legal authority that applies to data based on jurisdiction. Data localisation focuses on actions that keep or place data within a specified jurisdiction. Data residency focuses on the location, movement, and protection practices that arise from geographic and jurisdictional constraints.

Data residency semantic content includes:

• Data location
• Metadata location
• Geographic location
• Jurisdiction
• Cross-border movement
• Data transfer
• Data storage
• Data processing
• Data access
• Location-related risk
• Regulatory constraint
• Policy constraint
• Protection requirement
• Monitoring requirement
• Governance responsibility
• Traceability to residency rules and policies

issues and practices related to the location of data and metadata, the movement of data and metadata across geographies and jurisdictions, and protection against unintended access and other location-related risks

OMG Data Residency Working Group and OMG/Cloud Standards Customer Council Data Residency Challenges material, specialized for use in the FX Demo Reference Architecture.

Data residency does not apply only to data at rest. OMG's definition includes location, movement, geographies, jurisdictions, and protection against location-related risks. Data residency therefore applies to stored, moving, processed, and accessed data, as well as associated metadata, when location or jurisdiction affects the required controls.

An FX reporting node processes trade data for a trade subject to an EU reporting jurisdiction. A data residency rule requires raw counterparty data and validation evidence to remain within an approved EU processing environment. The architecture routes only report evidence to non-EU nodes and records the policy decision, location, jurisdiction, and transfer reason for audit purposes.

In this example, data residency concerns more than the physical storage location. It also governs movement, processing, access, metadata, routing, and protection against location-related risks.