What is the difference between data residency and data sovereignty?
Data residency is about where data is stored and processed; data sovereignty is about whose law and whose control the data is subject to. They are often confused because storing data in Frankfurt sounds like keeping it under European law. It does not necessarily: a provider headquartered outside the EU may be obliged by its home country’s law to hand over data it controls, wherever the server stands. Residency is easy to check on a map; sovereignty requires looking at the company that operates the service, its parent company, its sub-processors and who holds the encryption keys. For each vendor ask three questions: where is the data, who can be legally compelled to disclose it, and who can technically read it. NetSenX stores customer data in the EU, with the database in Ireland and the API in Frankfurt and Paris, and lists its sub-processors, some of them US-incorporated, in the data processing agreement. For full control, an on-premises option is available on the Enterprise plan.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- After the Schrems II ruling, can we still use security tools from US companies?
- Do a vendor’s data residency promises also cover logs, backups and support data?
- Which questions should we ask a security vendor about its sub-processors?
- Does a network monitoring service need a data processing agreement?
- Is the NetSenX data processing agreement public, and what does it commit to?