Data Localization

National legal frameworks place specific requirements for protection, tracking, and information auditing that either crosses a national border or applies to a data subject located within their jurisdiction.

Since legislation is different in each nation, it is vital to assess which local legislation is relevant for each company as they expand their business endeavors on a global scale.

An interesting example comes from the Russian Federation, where the Russian Federal Act on Data Protection requires that any data that describes or is about a Russian citizen, person, or business must be stored on IT systems (such as servers or storage devices) physically located within the territory of the Russian Federation, regardless of whether that data is used, owned, or controlled by a non-Russian organization. The implications here can result in companies that are either reluctant to operate within Russia or are required to have data centers based in Russia.

Another example of local data protection legislation affecting business decisions can be found in the European Union (EU). The General Data Protection Regulation (GDPR) specifies conditions that must be met before personal data can be transferred out of the EU and the European Economic Area (EEA) to a system in a country that does not comply with GDPR's requirements. American companies working with the encounter this problem on a regular basis. Since the United States has nothing comparable to GDPR, transferring data from an EU company to the United States is challenging.

These are only two of a growing number of data localization compliance issues that IT systems and their owners must address via information security plans and procedures.

Around the world, Cross-Border Privacy Rules (CBPR) are being legislated or put into regulatory frameworks to address data localization and the transit of privacy-related information across international borders.