Data Residency vs Data Sovereignty: Where Does Your Vendor Keep Your Data?
CyberRank Research
Data residency is where a vendor's systems and your data are physically hosted; data sovereignty is which country's laws and courts govern that data and any disputes. They often differ, and both affect transfer rules and access. CyberRank geolocates a vendor's public hosts and reads the governing-law clauses in its terms, then compares both with the countries you accept.
TL;DR
- Residency answers "where is it hosted?"; sovereignty answers "whose law and courts apply?".
- GDPR Chapter V and UU PDP Article 56 restrict cross-border transfers, so residency affects compliance.
- CyberRank checks residency and sovereignty separately against the lists you set.
How do data residency and data sovereignty differ?
Residency is a location question, sovereignty is a legal one, and a vendor can score well on one and badly on the other.
Residency is also not one place. A vendor's website, login portal, API and email may sit in different countries, and its sub-processors add more. That is why a single "we host in the EU" answer in a questionnaire rarely tells the whole story: check where each public system resolves, then ask about backups, support access and sub-processors. Sovereignty works the same way, because terms for different services can name different laws.
Both are part of a full vendor privacy risk assessment, next to the policy itself, which our short answer on checking a vendor's privacy policy covers.
| Aspect | Data residency | Data sovereignty | How CyberRank helps |
|---|---|---|---|
| Question | Data residencyWhere are the systems and data hosted? | Data sovereigntyWhich country's law and courts govern the data and disputes? | How CyberRank helpsChecks both separately |
| Evidence | Data residencyHosting locations of public systems, data centre regions | Data sovereigntyGoverning-law and jurisdiction clauses in terms and contracts | How CyberRank helpsGeolocates hosts and reads terms |
| Legal trigger | Data residencyGDPR Chapter V, UU PDP Article 56 on cross-border transfers | Data sovereigntyAccess requests, disputes and enforcement under the named law | How CyberRank helpsCompares with countries and jurisdictions you accept |
| Example | Data residencyHosted in Singapore | Data sovereigntyContract governed by Dutch law, Amsterdam courts | How CyberRank helpsReports each mismatch on its own |
Example: an EU retailer and an Indonesian processor (fictional)
A fictional Dutch retailer uses an Indonesian customer-service platform for its Asian shops.
The platform's public systems resolve to data centres in Singapore and the United States, and its terms name Indonesian law and the Jakarta courts. For the retailer, the US hosting is a transfer question under GDPR Chapter V; the governing law decides where a dispute or access request would be handled. Neither is a deal-breaker by default, but both must match the retailer's acceptance rules and transfer safeguards.
The retailer records its accepted countries and jurisdictions once, then applies them to every vendor, as the steps in our vendor privacy guide describe.
How CyberRank helps: CyberRank shows the hosting countries and the governing law it finds, and flags each one that falls outside the lists the retailer set.
Where CyberRank does not help
CyberRank sees public hosts and published terms. It cannot see where backups, internal databases or support staff are located, which sub-processors hold copies, or what your negotiated contract says about jurisdiction. Geolocation of a public host is an indicator, not proof of where all data rests. Confirm the full picture with the vendor's data processing agreement and sub-processor list.
References
Frequently asked questions
Check where your vendors host data
See hosting countries and governing law for every supplier, compared with the lists you accept.
Check where your vendors host data