where
Data residency
The physical or cloud location where data is stored and processed.
- Usually a choice: region, data centre
- Set by deployment and contract
- Proven by architecture and audit
Guide · Private AI deployment
Data residency for AI: where prompts, documents and answers are allowed to go.
An AI system copies data more often than the systems before it — into indexes, prompts, model calls, logs and backups. Each copy has a location.
Residency, sovereignty and localization are often used as if they meant the same thing. They describe different obligations, and AI adds a new question to all three: when a prompt carrying personal data is sent to a model in another country, has the data left? This guide defines the terms, follows the data through an AI system, sets out what GDPR’s transfer rules ask, and ends with a checklist.
Updated · 11 sources
A choice you makeA rule you must obey
123
- Data residencyData is stored and processed in a location you choose, usually for policy, contract or latency.
- Data sovereigntyData is subject to the laws of the place it sits — and of whoever can compel the company holding it.
- Data localizationA law requires certain data to stay inside a country, or to leave only after an approval.
What is data residency for AI?
Data residency for AI means keeping the data an AI system handles — documents, embeddings and search indexes, prompts, model outputs, logs and backups — stored and processed in a geographic location you choose. It differs from data sovereignty, which is about whose laws apply to that data, and data localization, which is a legal requirement to keep it in a country. For AI, the hard part is processing: a model call to another region can move data even when storage stays at home.
Definitions
Data residency vs data sovereignty vs data localization.
The three overlap, and contracts often blur them. Separating them tells you which ones a deployment choice can solve and which need a legal answer.
whose law
Data sovereignty
The laws that govern data, which follow both its location and the company that controls it.
- Local law where data sits
- Plus the provider’s home law
- A US provider can be ordered to disclose data it controls abroad
must stay
Data localization
A legal rule that certain data must be kept in a country, or may leave only on conditions.
- Set by statute or regulator
- Often sector- or volume-specific
- China’s PIPL is a well-known example
Why residency alone can fall short. Data stored in an EU region by a provider headquartered elsewhere has EU residency, but its sovereignty also depends on that provider’s home law. GDPR Article 48 says such foreign orders are recognised in the EU only through an international agreement, such as a mutual legal assistance treaty.
Data residency for AI systems
Data residency for AI: follow one document through the system.
A classic application stores a record and reads it back. An AI system converts it, splits it, embeds it, sends pieces of it to a model, logs the exchange and backs everything up. Residency has to hold at every stop.
- Store
The original file and its page images land in object storage.
- Index
Text is extracted, split and turned into embeddings in a search index — often by a model call of its own.
- Prompt
A question pulls matching passages into a prompt, which goes to a language model.
- Answer and log
The output is stored with the conversation, copied into run records, audit entries and telemetry, and may be sent on to other systems.
- Back up and support
Backups keep further copies, sometimes in a second region. A provider’s engineer viewing the data from a third country can be a GDPR transfer of its own.
GDPR Chapter V
GDPR transfers and AI: how Chapter V applies to model calls.
GDPR does not require EU data to stay in the EU. It requires that data leaving the EEA keeps an equivalent level of protection. The EDPB counts processing as a transfer when three things hold: the exporter is subject to GDPR, it sends or makes the data available to another controller or processor, and that importer is in a third country. Sending prompts that carry personal data to a model provider in a third country meets all three.
Does this AI data flow need a transfer tool?
The model and every store run inside the EEANo transfer from storage or inference. Check remote access too: a provider’s support staff viewing the data from a third country create one.
Data goes to a country with an adequacy decisionArticle 45 covers it. For the US this means a provider certified under the EU-US Data Privacy Framework.
Data goes to a country without adequacyUse an Article 46 tool — standard contractual clauses or binding corporate rules — and assess the destination’s law, adding measures such as encryption where it falls short.
None of those tools fitsArticle 49 derogations, such as explicit consent, are narrow exceptions and do not suit a system that sends prompts all day.
- May 2018GDPR appliesChapter V sets the rules for transfers outside the EEA.
- Jul 2020Schrems IIThe Court of Justice strikes down the EU-US Privacy Shield and keeps standard contractual clauses, with a case-by-case assessment.
- Jun 2021EDPB supplementary measuresSix steps for exporters: map transfers, pick a tool, assess the law, add measures, formalise, re-evaluate.
- Feb 2023What counts as a transferThe EDPB adopts final guidelines with three cumulative criteria; remote access from a third country, even on a screen, can be a transfer.
- Jul 2023EU-US Data Privacy FrameworkThe Commission adopts an adequacy decision for certified US organisations.
- Sep 2025Framework upheldThe General Court dismisses the Latombe challenge (T-553/23). An appeal to the Court of Justice was lodged in October.
Cross-border inference
Model calls across borders: where inference actually runs.
Cloud model services now separate where data is stored from where prompts are processed — and the cheapest default is often the widest. Read the deployment type before reading the region name.
Global processing
Prompts are routed to whichever data centre has capacity. Microsoft’s Global deployment types may process in any Azure region.
- Newest models first
- Lowest price, highest quota
- Data at rest stays in your geography
- Prompts may cross borders
Zone or regional processing
Prompts are processed only inside a data zone (US, EU, Asia Pacific) or inside the geography you chose.
- Processing stays in the zone or geography
- Fits residency rules
- Models can arrive later
- Capacity per region can be tighter
Global Standard, Global ProvisionedAzure OpenAI / FoundryData Zone, Standard, Regional Provisioned
Default projectsOpenAI APIEuropean data residency for eligible new projects, with zero data retention
—Your own modelRuns wherever you deploy it, on premises included
A transfer when prompts with personal data are processed outside the EEAUnder GDPRNo transfer inside the EEA; the EU zone can also use Norway (in the EEA) and Switzerland (adequacy)
Embeddings count too. Turning a document into embeddings is a model call. An index built in your region from vectors computed somewhere else has already crossed a border.
Checklist
A data residency checklist for AI projects.
Ask these before a pilot becomes a service — the answers belong in your records of processing and your transfer assessment.
Name every place the data goes
- Files and page imagesWhich region stores originals and their renderings?
- Search indexes and embeddingsWhere are vectors computed, and where are they stored?
- Model inferenceWhich deployment type, and which regions can process prompts?
- Provider retentionDoes the model provider keep prompts for abuse monitoring, and where?
- Conversations and run recordsWhere do chat history, tool calls and audit entries live?
- Backups and recoveryIs the backup region in the same geography?
- Onward systemsWhich connected systems receive outputs, and where are they?
- Support and operationsFrom which countries can staff reach the data?
- Localization rulesDoes any data fall under a law that requires it to stay, such as China’s PIPL for critical operators?
- Transfer toolsFor each flow out of the EEA: adequacy, standard contractual clauses or binding corporate rules — and the assessment behind it.
On Botminds
How Botminds keeps AI data in the region you choose.
In a Botminds deployment every store the platform keeps sits in the region you choose, and data leaves it only as the flows you configure.
What stays, and what leaves only by your choice
01
Stays in your regiondocuments, page images, extracted values, search indexes, conversations, run records and the audit trail
stored02
Backed up in your geographya paired region in the same geography, or a second site of yours on premises
recovery03
Model calls you approveyour Azure OpenAI or Azure AI Foundry in your own subscription and region, Bedrock in your AWS account, or a model on your own hardware
inference04
Results you routeoutputs sent to the systems you connect
onward05
Emails you choosenotification mail through the service you configure
notificationsIn a dedicated Azure environment the model account is reached over a private endpoint inside the deployment’s network, and your documents never train shared or third-party models. See private AI deployment and the LLM gateway.
Questions people ask
Data residency for AI: common questions.
The technology behind itPrivate AI deploymentAzure, AWS, Google Cloud or on-premises→What does data residency for AI mean?
Data residency for AI means the data an AI system handles — files, embeddings, prompts, outputs, logs and backups — is stored and processed in a location you choose. For AI the critical piece is inference: where the model actually processes your prompts.
What is the difference between data residency and data sovereignty?
Residency is where data is stored and processed. Sovereignty is whose law governs it — the law of the place it sits, plus the home law of the company that controls it. Data can be resident in the EU and still be reachable under another country’s law.
What is the difference between data sovereignty and data localization?
Sovereignty describes which laws apply to data. Localization is a specific legal rule that data must stay in a country — for example, Article 40 of China’s PIPL requires critical information infrastructure operators, and handlers processing personal information above volumes the state sets, to store personal information collected in China inside China.
Does GDPR require data to stay in the EU?
No. GDPR allows transfers outside the EEA when the destination has an adequacy decision, when appropriate safeguards such as standard contractual clauses are in place, or under narrow derogations. Many organisations still keep AI processing in the EEA to avoid the assessment.
Is sending a prompt to an AI model in another country a data transfer?
Under GDPR, it is when the prompt contains personal data and the model provider — another controller or processor — processes it outside the EEA. The EDPB’s three criteria apply, and remote access from a third country — even viewing data on a screen — can count too.
Does OpenAI offer data residency?
Yes, for eligible customers. In February 2025 OpenAI introduced European data residency: API requests in new European projects are processed in region with zero data retention, and new ChatGPT Enterprise and Edu customers can have their content stored at rest in Europe.
Is Azure OpenAI data residency guaranteed?
Data at rest stays in the resource’s Azure geography for every deployment type. Processing depends on the type: Global may use any Azure region, Data Zone stays within the US, EU or Asia Pacific zone, and Standard stays within the geography you chose.
How does Botminds handle data residency for AI?
Every store sits in the region you choose, backups go to a paired region in the same geography, and data leaves only as model calls to deployments you approve, results to systems you connect and emails you choose to send.
Sources
- GDPR (Regulation (EU) 2016/679), Chapter V: transfers to third countrieseur-lex.europa.eu
- EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V (final, February 2023)edpb.europa.eu
- EDPB Recommendations 01/2020 on supplementary measures for transfersedpb.europa.eu
- Court of Justice of the EU: Case C-311/18 (Schrems II)curia.europa.eu
- European Commission: adequacy decisions, including the EU-US Data Privacy Frameworkcommission.europa.eu
- Court of Justice of the EU: press release 106/25, judgment in Case T-553/23 Latombe v Commission (3 September 2025)curia.europa.eu
- Digital Policy Alert: Latombe appeals to the Court of Justice, Case C-703/25 P (October 2025)digitalpolicyalert.org
- Microsoft Learn: deployment types and data processing locations in Foundry Modelslearn.microsoft.com
- OpenAI: Introducing data residency in Europe (February 2025)openai.com
- DigiChina: translation of China’s Personal Information Protection Lawdigichina.stanford.edu
- 18 U.S.C. § 2713 (CLOUD Act)law.cornell.edu
Read next
Sovereign AIWho controls the data, models, compute and law under an AI system→On-premise LLM deploymentGPU sizing, serving stacks, open-weight models and trade-offs against cloud→AI governance vs data governanceWhat each one controls, who owns it, and where the two meet→All guidesEvery explainer, by topic→
See it on
your own work.
Bring one process and its documents. We’ll show you the agents, the controls and the record, running on your data.