# Data residency > Data residency is the requirement, whether legal, contractual or chosen, that data is stored and processed within a specific geographic location, such as a country or region. It is distinct from data sovereignty, which concerns which laws and authorities govern the data. Also known as: data localisation, in-country hosting, data localization ## Why does it matter? Governments running agricultural programmes or [national traceability systems](/glossary/national-traceability-system/) often require farmer and land data to be hosted in the country. The reasons include legal requirements, national security, public trust and the wish to build local capacity. Companies may face residency requirements in contracts with public agencies. ## How does it work in practice? - Data is hosted in data centres located in the required country or region. - Backups and disaster recovery also stay within the boundary, or follow approved rules. - Processing, including analytics, respects the same boundary or uses anonymised or aggregated data. - Contracts and technical documentation record where each data category resides. ## Common pitfalls - Hosting the primary database in-country while logs, backups or analytics run elsewhere. - Confusing residency with sovereignty and overlooking provider jurisdiction. - Not mapping which data categories are subject to which rules. - Residency so strict that legitimate, consented data sharing with buyers becomes impossible. Farmer1st supports in-country hosting for government deployments while keeping data interoperable with buyers' systems. See [data integration](/services/data-integration/). ## Frequently asked questions ### Is data residency the same as data sovereignty? No. Residency is about where data physically sits. Sovereignty is about who has legal authority over it. Data can reside in a country and still be subject to foreign laws through the provider's jurisdiction. ### Does the GDPR require EU data residency? No. The GDPR allows transfers outside the EU under conditions such as adequacy decisions or appropriate safeguards. Some national laws in producer countries do impose localisation for certain data. ## Sources - [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) - [European Commission, Data protection](https://commission.europa.eu/law/law-topic/data-protection_en) - [UN Office of the Tech Envoy, Digital public infrastructure](https://www.un.org/techenvoy/content/digital-public-infrastructure)