Translate a requirement into system questions
A residency statement such as ‘data stays in a country’ is not an architecture. Ask which data classes it covers, whether it applies to storage or access as well, whether encrypted backups and logs count, and who supplied the requirement. Legal and contractual interpretation belongs to the organisation's advisers; the deployment task is to make the technical facts visible.
The GDPR distinguishes controller and processor responsibilities, but it does not reduce residency to a single server address. A useful decision record identifies the processing activity, data category, location, transfer path, supplier, owner, and the evidence used to verify the claim.
Find every data copy and route
Map primary databases, replicas, object storage, search indexes, caches, queues, backups, disaster-recovery copies, developer environments, monitoring, logs, support tools, and analytics exports. Include metadata. A user identifier in telemetry or a database backup in another region can matter even when the main application database is local.
Map access too: administrators, support providers, incident responders, CI systems, and vendors may retrieve data across a boundary. Record whether access is ordinary operation, emergency-only, or prohibited, and how it is approved and logged.
Turn the map into architecture choices
Choose regions and services only after the inventory is complete. Configure replication, backups, log shipping, object lifecycle rules, and support access to match the decided boundary. A provider's regional label is evidence to check, not proof that every ancillary service, recovery copy, or operator path has the same location.
Use data minimisation in telemetry and support tooling. If a system needs only a pseudonymous request identifier to diagnose an error, avoid sending a full customer record. Reducing copies narrows both residency analysis and incident exposure.
Illustrative mapping exercise
For an illustrative employee portal, list its primary database, same-region replica, encrypted backup target, file store, search index, error tracker, email provider, identity provider, and support access path. Mark the country or region asserted for each, its data class, and the evidence owner.
The output is a decision list, not a legal conclusion. It shows that a proposed external error-tracking service would receive identifiers and asks the requirement owner whether that transfer is permitted before it is enabled.
Residency register
Keep a register that changes with the architecture.
| Component | Data or access | Question to verify |
|---|---|---|
| Primary store | Business records | Where is data persisted and replicated? |
| Backup | Recoverable copy | Where is it retained and who can restore it? |
| Telemetry | Operational metadata | Which fields leave the service and where are they stored? |
| Support route | Administrative access | Who can access data from which location and under what approval? |
Questions that uncover missed paths
Are encrypted backups outside the boundary irrelevant?
Do not assume so. Record the requirement owner's interpretation, key custody, restore path, retention, and provider location.
Does support access count?
It can. Map human and automated access routes, emergency controls, logging, and supplier responsibilities.
How is the map verified?
Use configuration evidence, supplier records, controlled access tests, and a review after every material architecture change.
A repeatable review
Inventory data classes, components, copies, suppliers, and access paths.
Compare the map with stated requirements, identify exceptions, and obtain the right owner decision.
Retain configuration and supplier evidence, test access controls, and recheck on change or recovery exercises.
Deployment checks
Keep evidence with the service record.
Copy inventory
Primary, replica, cache, index, backup, and telemetry locations are recorded.
Access review
Support and administrator paths are named, approved, and logged.
Change trigger
A new supplier, region, or recovery design triggers a residency review.
