During legal review of cloud provider contracts, which clause is critical to ensure data resides in specific geographic regions?

• A. Data Residency
• B. SLA Uptime
• C. Data Encryption
• D. Vendor Lock-In

Answer: (A)

Data residency ensures data is stored in specific geographic regions. In cloud contracts, a data residency clause binds where data must be stored and processed, which is crucial for meeting data sovereignty laws, industry regulations, and contractual expectations about jurisdiction. By defining allowed storage locations and often outlining how backups and disaster recovery centers are geographically distributed, it gives the organization a verifiable map of where data resides, making compliance audits and legal risk assessment clearer.

Data residency matters because laws and government access rules can vary by country or region. If data were stored or replicated in an unintended jurisdiction, the organization could face compliance gaps or legal exposure. A well-defined data residency clause also helps with data transfer considerations, ensuring cross-border movements align with applicable regulations.

In contrast, other contract elements address different concerns. Data encryption focuses on protecting confidentiality regardless of location, but encryption alone doesn’t control where data is stored. Service-level agreements concentrate on availability and performance rather than geographic placement. Vendor lock-in deals with portability and switching providers, not where data physically sits.