A cloud provider signs a contract agreeing to store a Canadian client's data exclusively on servers physically located within Canada, even though no Canadian law currently mandates that the data remain in-country. Which concept best describes this contractual commitment?
- ARight to erasure
- BData residency
- CData sovereignty
- DData localization law
Show answer & explanationAnswer & explanation
Correct answer: B. Data residency
Data residency refers to the physical or geographic location where data is stored, which can be a business or contractual choice independent of legal requirements. Data sovereignty refers to data being subject to the laws of the country where it is stored, and data localization laws are legal mandates requiring data to stay within a jurisdiction; here the restriction is contractual, not legally mandated, making residency the best fit.
Why the other options are wrong
- A. Right to erasure is a GDPR concept about deleting personal data, unrelated to storage location.
- C. Sovereignty concerns which country's laws govern the data, not simply where it physically sits by contract.
- D. A localization law would be a legal requirement, but the scenario states no such law exists.
Data Residency
The physical or geographic location where an organization's data is stored, which may be dictated by business, contractual, or performance considerations rather than law.
- Distinct from data sovereignty (legal jurisdiction over data)
- Distinct from data localization (legal requirement to store data locally)
- Often specified in cloud service contracts or SLAs
Memory trick: Residency = where it lives by choice; Sovereignty = whose laws rule it; Localization = law forces it to stay.