Data residency (AI and cloud)
Where your data is stored and processed, including where an AI model runs on it, and whether it can leave a region such as the EU.
Enterprise buyers and security questionnaires ask it in two parts: where data rests, and where it is processed. For AI the second part matters most, because a prompt may be sent to a model hosted in another country. Cloud providers and model vendors offer regional hosting, but logs, backups and sub-processors can still be elsewhere. It is related to, but separate from, GDPR transfer rules and zero data retention: data can stay in the EU and still be kept for a month.
Related terms
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
- Zero data retention (ZDR): An arrangement in which an AI provider does not store your prompts and outputs after returning the response, beyond what is needed to serve it.
- Data processing agreement (DPA): The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.
- EU-US Data Privacy Framework (DPF): The legal basis that lets EU personal data go to US companies that certify under it, without extra transfer contracts.
