The data residency question has become the question the enterprise has been quietly trying to answer, the question the procurement team has been asking, the question the regulator has been enforcing. The honest framing matters here, because the data residency the cloud architect has been promising the procurement team sits as the data residency the cloud provider has been quietly making harder to deliver as the cloud provider has been consolidating the regions.
What follows runs as the working version of the field guide. The shorter version is what the cloud architect and the privacy team actually have time to read.
What the data residency question actually is
Here is the working order, by impact. The first runs as the storage location, where the location the data sits at rest, the location the cloud provider has been storing the data in the region the customer selected, the location the customer can verify through the cloud console, the location the regulator has been asking the customer to confirm. The second runs as the processing location, where the location the data gets processed, the location the cloud function, the AI inference, the analytics run, the location the customer cannot always verify because the cloud provider has been routing the processing for the performance optimisation, the location the regulator has been asking the customer to confirm. The third runs as the backup location, where the location the backup sits, the location the disaster recovery copy lives, the location the cloud provider has been replicating to the other region for the resilience, the location the customer has not been able to control.
What changed in 2025-2026
Here is the order things have actually landed, in this sequence. The first runs as the sovereign cloud expansion, where the expansion the hyperscaler has been funding, the sovereign cloud the hyperscaler has been building for the EU, the Middle East, the Asia Pacific customer, the sovereign cloud that finally gives the customer the data residency the regulator has been asking for, the sovereign cloud the procurement team can now point to. The second runs as the regional lock in, where the lock in the hyperscaler has been creating, the lock in that comes from the services the hyperscaler only offers in the US region, the lock in the enterprise cannot avoid without the architecture change the architecture team has been postponing, the lock in the regulator has been quietly trying to address through the data portability requirement. The third runs as the data sovereignty enforcement, where the enforcement the regulator has been starting, the enforcement that the EU has been leading through the Schrems II follow up, the enforcement the state AG has been bringing against the US headquartered provider, the enforcement the enterprise should be tracking because the enforcement the regulator is doing is going to land on the enterprise the enterprise cannot avoid.
What the enterprise should do
Three moves if you are the enterprise that wants the data residency the regulator has been asking for. Map the data, where the map the privacy team should be producing, the map that names what data sits where, the map that shows the data flow (the collection, the storage, the processing, the backup, the analytics), the map the privacy team can use to know what the regulator is going to ask the privacy team to certify. Pick the right region, where the region the cloud architect should be selecting, the region that matches the data residency requirement, the region the cloud architect should be selecting for the new workload, the region the cloud architect can document the choice the cloud architect made. Architect for the portability, where the portability the architecture team should be designing for, the portability that lets the workload move between the regions without the rewrite, the portability the open source abstraction (the Terraform, the Kubernetes, the OpenStack) the architecture team can use, the portability the regulator is going to require the next time the regulator updates the data residency requirement. The team that maps, picks the right region, and architects for portability serves as the team that has answered the data residency question the regulator has been asking.
The bottom line
Data residency in 2026 sits as the question the regulator has been enforcing. The storage location, the processing location, the backup location, those three are what the question is. The sovereign cloud, the regional lock in, the data sovereignty enforcement, those three are what changed. The map, the right region, the portability architecture, those three are what the enterprise should do. The team that does the three answers the question. The team that has not done the three serves as the team that finds out the gap on the morning the regulator calls.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
