This new paradigm of data sovereignty has brought with it an increased level of sophistication in dangerous landscapes, making it more difficult to categorize threats.
While companies and governments might not have realized it at the time, before digitized data, keeping that data safe was straightforward. The party that had access to the data controlled it. Before digitization, your data was safe unless there was a physical breach.
Now, however, people and entities can potentially steal your data from their living rooms, located on the other side of the globe.
Consequently, Chief Information Security Officer (CISO) jobs become more difficult because much of the company’s data gets stored in the cloud. With that, the importance of Data Localization has grown to be a priority rather than an afterthought.
In this article, you will learn the following:
What is Data Localization?
Because the Internet makes it feasible for data to travel the globe in milliseconds, regulators, privacy advocates, and consumers are becoming increasingly interested in the destinations and the uses of such data. Thus, there is a spotlight on data localization.
Data Localization refers to storing data on any device physically located within the borders of a specific country where the data originated. Certain governments place restrictions on the free flow of digital data, particularly data that may affect the operations of the government or functions in a region.
Many efforts have been made to safeguard and promote security across borders, which is why many people advocate for the localization of data and why there are more and more countries with data localization requirements.
Data Localization vs. Data Residency
Although the terms data localization and data residency sometimes get used interchangeably, they have fundamentally different meanings. The term “data residency” refers to where data is kept and changing residency rules may force organizations to relocate their data. On the other hand, complying with these data residency laws is known as data localization.
Data Localization Laws Around The World
Data is rightly considered the heart of the modern global economy, yet transmitting protected data across borders is increasingly difficult. Businesses and their data services teams face increasing dangers from data governance and the varying data localization requirements between countries which results in increased difficulties for sharing data.
With that, here are some data localization laws by country:
EU Data Localization Laws
Regulated Data Types: Profile, Employment, Finance, Health, Payment
The GDPR, or General Data Protection Regulation, is a unified data protection regulation in the European Union. This regulation governs how personal data is processed within the EU and is an important part of the EU’s privacy and human rights legislation.
While the EU does not have particular data localization laws, many businesses have already taken steps to guarantee that their data strategies include localizing regulated data before leaving their home nations.
Russian Data Localization Laws
Regulated Data Types: Profile, Finance, Employee, Health
The Data Protection Act No. 152 FZ dated 27 July 2006 (DPA) and several regulatory acts approved to implement the DPA are Russia’s primary sources of data protection rules.
If you can use the information to identify a specific person, it gets deemed personal data. Companies are only subject to localization rules if they knowingly engage in the following activities: collecting, recording, systematization, amassing, storing, clarifying, updating, changing, and extracting personal data.
However, the rule regarding the residence of data in Russia does not restrict the future processing of the personal data of Russian citizens in a foreign country. This stipulation is secure, provided that the fully-updated data has already gotten included in Russia’s database.
Consequently, it is possible to use databases outside Russia to carry out activities such as the utilization, transfer, depersonalization, blocking, removal, or destruction of personal data.
UAE Data Localization Laws
Regulated Data Types: Finance, Health, IoT, Profile, Government Data
The UAE Central Bank and the Telecommunications Regulatory Authority are responsible for enforcing the rules and regulations that govern data protection in the country. These federal laws and regulations of the UAE contain a variety of measures that relate to the security of personal data and the privacy of individuals.
There is one issue on which everyone can reach a consensus: the significance of protecting one’s data. Consequently, there is likely to be a rise in the number of regional disparities in laws governing privacy as there are more and more countries with data localization requirements.
GDPR Data Localization Requirements
As was just indicated, the GDPR controls “Profile,” “Employment,” “Finance,” and “Health” data.
Organizations that receive and store any regulated data must comply with the rules of GDPR. According to GDPR, businesses are obligated to maintain the security of the data while it is within the EU. If the information is transferred outside of the EU, it can only get transferred to countries or organizations that have signed up for equal privacy protections.
In this context, “transfer” refers to moving the source data to a machine outside the EU. However, it is also possible for a worker outside the EU to access the data.
Since data goes to another country whenever one of these manipulations takes place, technically speaking, it is also considered a transfer of data; hence, you will need to ensure that only EU citizens and machines interact with the data in an ideal world. When data is kept, processed, or accessed from outside the EEA, it gets regarded as transferred.
This transfer process has significant repercussions on the processing architecture that you use. For instance, if you have customers in both the United States and other countries, you will need to store and process data in different countries separately for each customer base.
However, such a transfer is still permitted as long as the recipient agrees to apply the GDPR data localization requirements and principles or if the recipient uses a specialized data residency-as-a-service provider that assists in protecting the data while it is getting transferred.
Examples of Data Localization Requirements
Some data must be stored on servers within the country due to national legislation requirements. Some other reasons include the need to comply with data protection laws and regulations for data security and, more broadly, national security.
Data storage within a country is particularly apparent when it comes to cross-border data flow transfers. This occurrence seems to be a cost-effective and better solution especially in situations where enterprise customers of data storage technologies advocate for in-country data collection, storage, and transfer solutions.
Aside from the GDPR, the criteria for data localization laws by country are quickly expanding and have been imposed in several countries, including Vietnam, Indonesia, Brunei, Iran, China, Brazil, India, Australia, Korea, Nigeria, and, most recently, Russia.
Some of these countries have a complete prohibition on the transfer of any categories of data, while others, like Australia and South Korea, have very specific restrictions on the transfer of data in very specific industries, like the health and financial industries, to protect the sensitive data of their citizens.
Additionally, there are stringent permission procedures and regulatory permits in certain nations, such as Malaysia and the Philippines, that you must obtain before transferring data internationally.
These policies have a tendency to make the operational processes more laborious, which frequently leads to the forced localization of data. Thus, when a foreign company wants to supply various information technology services in some nations, such as India, it must form local partnerships.
Every day, the world increasingly shifts digital, and with it comes new differences in data localization laws by country. For example, what one nation may consider appropriate use of personal information may get regarded as problematic in another one. With that, a service like Satori can ensure that data seamlessly transferable across different countries adhering to the varying countries localization requirements.
Conclusion
The localization of data is becoming increasingly significant for data owners. More and more government authorities worldwide are expressing support for stricter rules for data localization. And as is usual, the global community may anticipate seeing privacy and data protection legislation that differs greatly from one country to the next.
Privacy teams are responsible for maintaining a careful eye on the established norms and any new ones that may emerge as governing organizations continue to release new guidelines. Because of this, teams will need to alter their data storage and processing systems to comply with the new requirements, which is not an easy task considering the intricacies involved with the process.
Satori And Data Localization
Read here how Satori helps data localization projects and requirements.
Satori helps you with DataSecOps for your modern data stack. This includes continuous sensitive data discovery, integration with existing data governance tools to make data governance more efficient and immediate, and means to streamline access to sensitive data and create security policies that are independent of the specific data infrastructure you’re using.
