A compliance analyst is preparing training for new DBAs on cloud data placement. Which statement correctly distinguishes data residency from data sovereignty?
Select an answer to reveal the explanation.
Short Explanation
Here's an easy way to keep them straight: residency is your data's home address, sovereignty is whose laws it has to obey. They often line up, but they're not the same thing. The swapped definition is the trap, so slow down and match 'where' to residency.
Full Explanation
Data residency describes the geographic location where data is physically stored and processed, which organizations may choose for performance or business reasons or be required to choose by regulation or contract. Data sovereignty describes the legal principle that data is subject to the laws and governance structures of a particular jurisdiction, such as the country where the data subjects reside or where it was collected. The two often interact: a residency requirement is one way a jurisdiction asserts sovereignty, and storing data in a given country also exposes it to that country's laws. However, they answer different questions, where versus whose law. Swapping the definitions is the most common error and leads to designs that keep data in the right place while ignoring the legal obligations attached to it. Neither term concerns how long data is kept; that is retention. Neither is defined by the state of the data; at rest versus in transit is an encryption and security distinction, not a jurisdictional one. Exam caveat: data localization is a related term for laws that require data to stay within a country, effectively a mandatory residency rule. Operational check: for each data store, record both its storage region and the jurisdictions whose laws apply, and review both before any migration.