Data Localization and Residency

Abstract

Data localization is the most widely legislated sovereignty control and the most frequently over-simplified in implementation. This paper separates the legal obligation (where data must reside, and under what conditions it may leave) from the technical mechanism used to enforce it (encryption key placement, tokenization, network egress control, and metadata leakage), and shows why systems that satisfy the letter of a residency statute often fail its intent. It surveys the current regulatory landscape — GDPR’s cross-border transfer regime, China’s Data Security Law and Personal Information Protection Law, and India’s Digital Personal Data Protection Act — traces the historical evolution of localization law, examines ten detailed case studies, and provides a technical enforcement checklist that composes with the sovereign cloud patterns in SDIS-02 and the cross-border governance treaties in SDIS-11. It closes with an implementation roadmap, a glossary, and a self-assessment checklist.