Data sovereignty vs data residency vs data localisation, in plain words

These three terms get mixed up in almost every vendor conversation. The difference matters, because a cloud can meet one and fail the other two.

The three terms

Real examples

• Localisation in India: since 2018, the RBI requires payment system data to be stored only in India.
• Cross-border transfers under DPDP: personal data may go abroad, except to countries the government restricts by notification.
• The GCC: Saudi Arabia's PDPL and UAE rules set conditions on sending personal data outside the country.
• Sovereignty gap: data stored in an Indian data centre by a foreign provider can still be reachable under that provider's home-country laws.

Quick quiz: which one is it?

Four questions to ask any vendor

1. Where exactly is our data stored, including backups?
2. Which country's laws apply to you as a company?
3. Who holds the encryption keys?
4. Can the system run entirely on our own servers, with no outside connection?

Each term, a little deeper

Data residency

Residency is a fact about location. If your data sits in a data centre in Mumbai, its residency is India. Companies often choose residency for speed, cost or customer comfort, even when no law requires it.

Data localisation

Localisation is a legal requirement. A law or regulator says certain data must be stored, and sometimes processed, inside the country. It usually applies to specific sectors or types of data, not everything.

Data sovereignty

Sovereignty is about power. Which country's laws apply to the data, and who can be forced to hand it over? Data can be stored in India and still be reachable under another country's laws if the company running the system is based abroad.

The sovereignty gap, explained

The United States CLOUD Act of 2018 allows US authorities to require US-based providers to produce data in their control, even when it is stored in another country. Other countries have similar powers. This is why "the data is in an Indian region" does not always settle the question.

Deployment options compared

A note on the GCC

• Saudi Arabia: the Personal Data Protection Law came into force in September 2023, with a year to comply. It limits transfers of personal data outside the Kingdom to set conditions.
• UAE: the federal Personal Data Protection Law (Decree-Law 45 of 2021) also sets conditions on transfers abroad. Free zones such as DIFC and ADGM have their own rules.

How to decide what you need

1. List the data you hold by type: payment, health, personal, business.
2. Check which sector rules apply to each type.
3. Decide who must never be able to reach the data, and design for that.
4. Choose the deployment option that meets the strictest need.

Sector rules in India

Beyond the DPDP Act, some regulators set their own rules on where data must stay:

• RBI: payment system data must be stored only in India (2018).
• SEBI: its 2023 cloud framework expects data of regulated entities, such as brokers and fund houses, to stay in India.
• Other sectors: insurance, telecom and government work often carry their own conditions. Check the rules for your sector.

Common myths

• "Encryption solves it." Only if you hold the keys. If the provider holds them, they can be asked to decrypt.
• "A local cloud region means we comply." It helps with residency. It may not settle sovereignty, or every sector rule.
• "Sovereignty means we cannot use the cloud." Not always. It means you must control who can reach the data, which a private cloud or your own servers can give you.

Questions your board will ask

1. Where is our most sensitive data stored today, including backups?
2. Could any foreign authority compel access to it?
3. Which of our vendors hold copies of it?
4. If a regulator asked tomorrow, could we prove all of this?

Key terms

• Cross-border transfer: sending personal data to another country.
• Key management: who creates, holds and controls encryption keys.
• Sovereign cloud: a cloud service designed so that data and control stay within one country.

Where Samvrik fits

Samvrik runs inside your own environment: on your servers or your private cloud, air-gapped if needed. RUSH never hosts your data. That gives you residency, meets localisation rules, and keeps sovereignty with you. See how Samvrik works.

Sources: RBI circular on storage of payment system data (April 2018); Digital Personal Data Protection Act, 2023, Section 16. Plain summary, not legal advice.

Common questions