Data residency is about where data sits. Some governments require personal data about their citizens, or specific categories like payroll and health records, to stay on servers inside their borders. For employers that means employee data: identity numbers, bank details, salary, everything held in the HRIS.
Three terms that get mixed up
Residency means the data is stored locally. Localisation is stricter: it must be processed locally too, with copies abroad restricted. Sovereignty means the data answers to the laws of wherever it is held. When a vendor promises "residency", ask which one they mean.
Where the rules apply
Russia and China have the best-known localisation laws. Others apply residency rules to specific sectors such as banking or health. The EU has no general rule but restricts transfers out, which pushes many employers toward EU-hosted systems anyway.
Why it matters when hiring through an EOR
The Employer of Record's systems become the record for employees in that country. Ask where they are hosted and whether they meet local rules. It sits alongside data protection compliance and cross-border data transfer, and it can rule out some providers in some markets.