Cloud storage data residency: How to achieve compliance

Availability zones

AWS, for example, offers availability zones (AZs) in North America, South America, EMEA and Asia Pacific. In Europe, AWS has regions in Ireland, the UK (London), Frankfurt, Paris and Stockholm. Each region has three AZs.

Microsoft’s approach is similar, with Azure regions and geographies. These, Microsoft says, “define disaster recovery and data residency boundaries” for Azure. Its availability zones are physically separate datacentres within regions.

Google Cloud’s platform offers regions and zones, but the cloud service also provides highly detailed information on technical capabilities in each zone. For storage, all regions and zones offer local SSDs, for example. Not all offer GPUs for GPU-accelerated tasks.

The picture is slightly more complicated when it comes to buying cloud services through third parties where an application could be built on top of a public cloud provider’s services. This could be a software-as-a-service (SaaS) application, a collaboration tool or even data archiving.

In this case, it is the third-party service, not the hyperscaler, which decides where data is stored. So, customers need to check the data residency terms of the service they are buying, both in normal operations, and to determine what would happen in the event of an outage.

Larger businesses, especially, will want to do their own due diligence for where data is stored, says Lee Sustar, a principal analyst at Forrester who leads cloud research. “You need to be prepared to validate that independently,” he says. “You can’t just rely on a set of generic documents.”

And, he points out, cloud computing is not static. The technology continues to evolve, with techniques such as object storage sharding dividing up data in new ways, and potentially bringing its own regulatory challenges.

Data residency and sovereignty regulations

Data residency and data sovereignty are increasingly governed by local laws. There is an increasing push towards data sovereignty, in part because of supply chain and security concerns.

As Mathieu Gorge, CEO at compliance experts Vigitrust, points out, firms and governments alike are increasingly concerned about geopolitical risk. Firms also need to be aware of data adequacy requirements if they intend to move data across borders.

This could come into play if they move between hyperscaler regions and AZs, or change SaaS providers. “There is adequacy between the UK and EU, but you are still relying on clauses in the contract to demonstrate that adequacy,” he cautions.

Meanwhile, the challenge of data residency is becoming more complicated as more countries roll out data sovereignty regulations.

The EU’s GDPR does not actually include stipulations on data residency, relying instead on data adequacy. The UK’s post-Brexit approach follows that of GDPR.

But the growth local of data privacy laws is increasingly linked to more localised, or even nationalistic, views of IT resources, and specific regulations and laws can also set out data residency requirements.

Even in the EU, individual countries are also free to modify their data privacy laws. Germany’s Bundesdatenschutzgesetz, or Federal Data Protection, is an example.

Outside the EU, new data protection laws in Russia and India are likely to impact firms doing business there, and could require them to store or process data in localised regions or AZs. This trend looks likely to continue. Research by the United Nations found that 130 countries now have data privacy laws.

Industry-specific regulations can also apply. The US HIPAA health data law and the international PCI-DSS payment card regulation both set policies around data residency, for example. IT departments need to be aware of these, and ensure that cloud storage is compliant.

Transparency and service level agreements

However, as data compliance experts point out, it is one thing to understand local laws and practices but quite another to know exactly where all data is across all applications.

If a firm has a chief data officer, this assurance will be part of their role, but organisations that buy cloud services need to ensure they review data location rules for each service and ensure service level agreements are clear about where a service keeps data. That should apply to business-as-usual and emergency scenarios, and how that can be audited.

This applies to any service that moves personal data, whether it is a simple cloud utility or an enterprise-wide system.

Organisations also need to monitor the changing regulatory and legal landscape, with a proliferation of local laws.  “I don’t see anything that will stop that,” says Forrester’s Sustar. “It is part of a broader trend of economic nationalism.”