Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed and stored and transmitted?

data storage locations

The location of data storage affects how data must be handled and the availability of that data.  Companies ask for location information so that they can understand the legal requirements related to that data.  Disaster planning is also affected by locations of the data.

Why are they asking this?

Companies are concerned about where their data is stored due to laws and regulations.  The European Union, for example, has laws that require personally identifiable information (PII) to be stored only within countries that have the same privacy laws as the EU member states. Some states in the United States are starting to pass their own laws about how data is collected, processed, and retained.  The location of the data can affect the laws that govern that information.


When data is exported from one country to another, there are other legal concerns, especially if the data could be sensitive or have military value.  


Organizations may have additional concerns about the location(s) of their data because of disaster recovery concerns.  If you provide storage that may be used by companies for backups, then backups should not be stored in a geographic location that would be affected by the same natural or man-made disaster. This same concept applies to data only existing in the cloud. The organization would expect that the data is stored in two locations that would also not be affected by the same natural or man-made disaster.

What do they expect?

Organizations expect to know the general location of their data.  While addresses may be withheld for security reasons, organizations need to know the country and metropolitan area where data is stored.