Data Location

The decision of where to store data is influenced by different factors including local legislations and regulations, in particular when it comes to private data that, as mentioned before, is addressed differently around the world.

When an organization makes the decision to collect and store personal data, they should first map out the local and global requirements that may affect the places in which they can store the data, the protection mechanisms they are expected to uphold, retention periods, etc. In some cases, local legislation may impact the decision on whether an organization operates in a particular region or not. The business decision of entering a new market, for example, may be greatly impacted by the local requirements and whether or not it makes financial sense to operate in said region.

Data is a portable resource, capable of moving swiftly and easily between locations both inside and outside the organization.

For example, it could be generated in the internal network, moved into the cloud, and then moved to another provider for backup or archival processing.

• Who are the actors that potentially have access to the data?
• What are the potential locations for the data?
• Where are the actors coming from (what locations and are they trusted or untrusted)?
• What are the controls in place in each of these locations?
• At what phases in each lifecycle can data move between locations?
• How does data move between locations (via what channels)?