08 / Trust & Governance
Data residency
Where data is physically stored and processed. Many organisations, especially public bodies and regulated industries, must keep certain data in specific countries or regions.
How you’ll hear it
“Can the ministry use this assistant?”
“Only if processing stays in-country. Check the provider’s residency options.”
Avoid
Assuming a provider’s standard terms meet your jurisdiction’s rules.
The longer version
Data residency decides which laws apply to your data and who can reach it. For organisations under GDPR, and for governments with national data rules, the Gulf states included, it often decides which AI providers are usable at all. Ask where data is processed, stored and logged, not only where the company is based.
In depth
Data residency is about where data is physically stored and processed, and therefore which laws apply to it and who can reach it. With AI, the question covers more than storage: prompts, uploaded files, outputs, logs and any data used to improve the service.
For organisations under GDPR, sending personal data outside the EU needs a legal basis and safeguards. Governments and regulated sectors often have stricter rules, and several Gulf states now have national data protection laws with their own conditions on transfers. In some cases these rules decide which AI providers can be used at all.
Providers increasingly offer regional processing, and open-weight models can run on infrastructure you control. The details matter: data may be processed in one region, logged in another and reviewed by support staff somewhere else.
Residency is a contract question as much as a technical one. The answer lives in the data processing terms, not the marketing page.
What to do
- Ask providers exactly where prompts, files, outputs and logs are processed and stored, and for how long.
- Check whether your data is used to train or improve their models, and how to switch that off.
- For sensitive work, consider regional processing or an open-weight model you host yourself.