Health data residency and sovereignty

In short

Data residency refers to where data are physically stored; sovereignty, to which laws and authorities can decide over them. The distinction matters for health data, because storing data in one country does not stop another country's law from reaching whoever holds them. Laws respond differently: some require storage in a territory and others allow transfers with safeguards.

Type

Concept

Steward

No single steward: general concept or generic technology

Reviewed

October 25, 2026

Explanation

What it is

In this glossary we use three related notions:

Residency: where data are stored and processed.
Localization: a legal obligation to keep data, or a copy, within a territory.
Sovereignty: which laws and authorities can decide over the data, including access by foreign governments. In a broader sense, also a community's ability to govern the data that describe it.

There is no single official definition; each law regulates some of these pieces.

How different jurisdictions regulate it

Jurisdiction	Law	Approach
European Union	GDPR, Chapter V	No general localization requirement: transfers outside the EU are allowed with an adequacy decision (Art. 45) or other safeguards (Art. 46)
European Union	EHDS, Arts. 86 and 87	Allows national law to require that priority-category data for primary use be stored in the EU; requires health data access bodies to store and process in the EU, except in countries with adequacy
Brazil	LGPD and CD/ANPD Resolution 19/2024	International transfers with mechanisms such as standard contractual clauses
Canada	PIPEDA	According to the OPC, it does not prohibit transferring information to another jurisdiction for processing; the organization remains accountable
United States	CLOUD Act (18 U.S.C. 2713)	Providers must preserve or disclose data in their possession, custody or control, whether located inside or outside the country

The Indigenous perspective

The CARE Principles for Indigenous Data Governance, from the Global Indigenous Data Alliance, complement the FAIR principles with a people- and purpose-oriented approach. They were drafted at a workshop held in Gaborone (Botswana) on 8 November 2018.

Implications for health projects

Document where each dataset is stored and processed, including backups.
Check which law governs the provider, not just where its servers are.
Review the transfer bases: adequacy, contractual clauses or other safeguards.

Common misconceptions

Confusing residency with sovereignty. The CLOUD Act reaches data outside the United States if the provider controls them.
Believing the GDPR requires data to stay in the EU. It allows transfers with the Chapter V safeguards.
Generalizing the EHDS. The Article 87 obligation targets health data access bodies and those acting on their behalf.

Usage examples

EHDS Article 87 requires health data access bodies to store and process personal data in the Union, except in countries covered by a GDPR adequacy decision.

EHDS Article 86 allows a Member State to require by law that patient summaries, prescriptions and other priority categories for primary use be stored in the Union.

In Brazil, CD/ANPD Resolution 19/2024 approved the international data transfer regulation and the standard contractual clauses.

According to the OPC's guidelines on cross-border processing, PIPEDA does not prohibit transferring data to another jurisdiction for processing, but the organization remains accountable.

The US CLOUD Act (2018) requires providers to disclose data under their control even if stored outside the country.

The Global Indigenous Data Alliance's CARE Principles complement the FAIR principles with a people- and purpose-oriented approach to Indigenous data.

Interoperability assessment

Architecture definition

Data modeling

Implementation Guides

FHIR layer

HIE Integration

Cloud Repositories

Kivú RIS

Kivú PACS

Kivú FHIR

Kivú Terminology

Kivú Conquest

Kivú eSignature