Data residency

An object store implements placement by creating the bucket in a region. AWS documents that a bucket lives in one region. Objects written to it stay in that region unless a replication rule copies them out. Residency is that placement plus the policy that forbids the copy.

The legal constraint and the technical control are different layers. GDPR Article 44 restricts transfer of personal data to a third country. A bucket in Frankfurt does not, by itself, satisfy that article. It is the control an operator uses so the bytes are not silently written to another region. A support tool that pulls a copy to a laptop in another country is a transfer even if the bucket never moved.

A hospital requires imaging files to remain in a named country. The bucket is created in that country's region. A lifecycle rule that tiers objects to a cheaper class is fine if the class stays in-region. A replication rule added later for "disaster recovery" into another region breaks the rule without an upload failure. The next audit finds replicas the runbook did not mention. Uploads from abroad do not change residency. A photographer in another country can PUT into the in-region bucket. The bytes land where the bucket is. The photographer's laptop still holds a copy, which is a second location the bucket policy does not cover.

Region is not encryption. A file in the right country can sit in the clear. A file in the wrong country can be encrypted and still be in the wrong country. Multi-region buckets and CDNs complicate the claim. An edge cache outside the region holds bytes. A residency rule that ignores caches and backups is a rule about the primary bucket only, and it should say so.