Privacy
Data residency
Also called data location.
Data residency is the geographic place where stored data physically sits. It is a fact about servers, separate from who can access them.
How it is measured
Read the vendor's region setting and its list of storage locations. Include backups, logs, and support access. A choice of "EU region" may cover the main database but not a log archive elsewhere.
Check by asking where each category lives and from where staff can read it. Remote access from another country can count as a transfer under GDPR.
Worked example
A Berlin design studio picks an EU region for its project tool. The main store is in Frankfurt. The vendor's support team in another country can view tickets, and the studio finds this in the vendor's subprocessor list.
The studio adds the transfer terms to its records.
How it differs
Data residency is where data sits. Data retention is how long it stays. Residency excludes duration; retention excludes location.
Common errors
Treating residency as the same as legal protection. Forgetting backups. Ignoring support access. Assuming a local brand means local storage. Stating a region in marketing without checking.
In practice
Ask your top five vendors where data and backups live and who can access them. Put the answers in one table.