Regional Data Residency and Privacy Law
Identity data is personal data by definition, and several jurisdictions restrict where it can go. Design residency in from the first schema: give every user and tenant a home region, keep their records there, and make every cross-region flow a deliberate, documented decision. This chapter is an engineering map, not legal advice; confirm obligations with counsel for each market.
The rules that shape identity architecture
| Jurisdiction | What matters for identity data | Status as of November 2026 |
|---|---|---|
| European Union (GDPR) | Transfers outside the EEA need an adequacy decision, standard contractual clauses, or another Chapter V mechanism | The EU-US Data Privacy Framework stands: the General Court dismissed the Latombe challenge on September 3, 2025, and Latombe's appeal (Case C-703/25 P) is pending at the Court of Justice (Bird & Bird, EUR-Lex appeal notice) |
| India (DPDP Act and Rules) | Notice and consent, security safeguards, breach reporting, and transfer restrictions the government can impose; localization possible for Significant Data Fiduciaries | Rules notified November 13, 2025; the remaining obligations phase in over 12 to 18 months, through May 13, 2027; breaches must be reported to the Data Protection Board without delay, with a detailed report within 72 hours (Hogan Lovells) |
| China (PIPL) | Volume thresholds decide the transfer mechanism: no filing under 100,000 individuals a year; standard contract or certification from 100,000 to 1 million (or any sensitive data under 10,000); CAC security assessment above 1 million, or above 10,000 for sensitive data. Some contract-necessity transfers are exempt (Freshfields) | In force since March 2024 provisions |
| Others | Many countries add sector rules (finance, health, government) that require in-country storage | Check per market and sector |
Biometrics deserve a note: with passkeys, the biometric never leaves the user's device. Your server stores only a public key. Say so in your privacy notice, because users and regulators often assume otherwise.
Cell architecture for residency
The pattern that scales is a set of regional cells, each a full copy of the identity stack:
- Each cell has its own identity services, user store, session cache, KMS keys, and audit log, deployed in one jurisdiction.
- A global routing layer holds only a keyed hash of each normalized identifier mapped to its cell. Given an email at sign-in, it hashes it and routes to the right cell without storing the email in readable form.
- Tenants pick a region at creation for B2B. Consumers are assigned by signup country, with a documented rule for travelers and moves.
- Region moves are a supported, audited operation: export from one cell, import to another, delete from the source, update the routing index.
- Issuer design: either one issuer with per-cell signing keys (simpler for clients) or one issuer per cell (cleaner separation). Decide before your first enterprise customer integrates.
What tends to leak across regions
Audit every one of these, because they break residency even when the database is regional:
- Logs and traces shipped to a central observability tool
- Error trackers capturing request bodies with emails
- Email and SMS providers processing data in another country
- Analytics and product events keyed by email
- Support tools and ticket systems
- Backups replicated to another region
Privacy engineering basics
- Collect the minimum: identity needs an identifier and credentials, not a birthday.
- Record the legal basis or consent for each purpose, with timestamps and versions.
- Build export and deletion as APIs, then put the user-facing buttons on top.
- Keep a data map of every field, where it lives, who processes it, and how long it is kept.
- Set retention periods for audit logs that satisfy both security and privacy, and write them down.
Warning
Common mistakes
- A single global users table with a
countrycolumn and a promise to shard later. - Regional databases with global logging pipelines.
- No supported way to move a user between regions.
Key takeaways
- Give every user and tenant a home region at signup and keep their records there.
- Regional cells plus a global routing index of keyed identifier hashes scale residency cleanly.
- Logs, error trackers, message providers, analytics, and backups leak data across regions; audit each one.
- With passkeys, the biometric never leaves the device. Say so in your privacy notice.