ISC2 CISSP (Certified Information Systems Security Professional)Security and Risk ManagementMedium
A global manufacturing company is expanding its operations into a new region. Before establishing local data centers and processing customer data, the legal team identifies that the new region has stringent data protection laws requiring data to be processed and stored within its national borders. Which of the following concepts is the legal team primarily addressing?
- AData Portability
- BData Sovereignty
- CData Residency
- DData Minimization
Show answer & explanationAnswer & explanation
Correct answer: C. Data Residency
Data residency refers to the physical or geographic location where an organization's data is stored and processed, often dictated by legal or regulatory requirements of a particular jurisdiction. The scenario directly describes laws requiring data to remain within national borders.
Why the other options are wrong
- A. Data portability is the ability to move data from one environment to another, not about where it must physically reside.
- B. Data sovereignty implies that data is subject to the laws of the country where it is stored, but the scenario specifically focuses on the requirement for data to be stored within borders, which is data residency.
- D. Data minimization is the principle of collecting only the necessary amount of data, not about its storage location.
Data Residency
The physical or geographic location where an organization's data is stored and processed. It is often a legal or regulatory requirement dictating that certain data must remain within the borders of a specific country or region.
- Dictates where data must be physically stored.
- Driven by national laws and regulations (e.g., GDPR, CCPA).
- Impacts cloud computing strategies and international data transfers.
Memory trick: Residency is 'where' data 'resides' by law, usually a country.