Data Localization and Sovereignty Laws

Data localization and sovereignty laws require that certain categories of data be stored and processed within a specific jurisdiction's borders, reflecting a global trend toward digital territorialism. Russia's Federal Law 152-FZ (amended 2015) requires personal data of Russian citizens to be stored in databases located in Russia. China's Personal Information Protection Law (PIPL, 2021) and Data Security Law (DSL, 2021) impose cross-border transfer assessments, security reviews by the Cyberspace Administration of China (CAC), and special treatment for "important data." India's Reserve Bank (RBI, 2018) requires all payment data to be stored in India, while the Digital Personal Data Protection Act (DPDP, 2023) restricts cross-border transfer to notified countries. The EU's GDPR Articles 44–49 govern transfers of personal data outside the European Economic Area through adequacy decisions, standard contractual clauses (SCC), and binding corporate rules (BCR). The US CLOUD Act (2018) addresses cross-border government access to data held by US providers.

The frameworks reflect two distinct concerns that sometimes conflict. The first is sovereignty — the belief that a nation's data should be subject to its own laws, that government access should not depend on foreign jurisdiction, and that national security requires local control of critical data infrastructure. The second is privacy — the protection of individuals' data from foreign surveillance or inadequate protection. Russia and China emphasize sovereignty; the EU emphasizes privacy (the Schrems II decision invalidated the EU-US Privacy Shield because US surveillance law did not provide adequate protection for EU data subjects).

This page covers localization mandates, transfer mechanisms, government access, jurisdictional conflicts, and practical compliance for organizations operating across multiple data sovereignty regimes.

Russia's 152-FZ, amended in 2015, is one of the strictest localization laws. It requires that personal data of Russian citizens collected by operators be initially recorded, stored, and processed in databases located in Russia. While subsequent processing abroad is permitted (with the operator remaining liable), the initial storage must be domestic. The Roskomnadzor (the Russian data protection authority) enforces compliance and can block access to non-compliant services.

China's framework is comprehensive and layered. The PIPL (2021) requires security assessments for cross-border transfers of personal information above certain thresholds, standard contracts, or certification. The DSL (2021) designates "important data" and "core data" subject to special treatment, including CAC security review before any cross-border transfer. The Cybersecurity Law (2017) adds Critical Information Infrastructure (CII) operator obligations, including in-country data storage for CII operators. The combined effect is a system where most cross-border data flows require some form of government review or approval.

India's approach is sector-specific for localization. The RBI's 2018 directive requires all payment system data to be stored only in India, though it permits processing abroad with the condition that the data is returned to India and deleted abroad within a short period. The DPDP Act (2023) takes a different approach for general personal data: it restricts cross-border transfer to countries notified by the central government as providing adequate protection, but does not impose broad in-country storage requirements — a notable departure from earlier draft versions that proposed localization.

The GDPR (Articles 44–49) restricts transfers of personal data outside the European Economic Area. Transfers are permitted to countries with an "adequacy decision" — a determination by the European Commission that the country provides a level of data protection essentially equivalent to the GDPR. The EU has granted adequacy to a growing list of countries and, in 2023, to the EU-US Data Privacy Framework (DPF) for certified US companies. For non-adequate countries, transfers require appropriate safeguards: Standard Contractual Clauses (SCC), Binding Corporate Rules (BCR) for intra-group transfers, or approved codes of conduct and certifications. Derogations (explicit consent, necessity for a contract) apply in limited cases.

The Schrems II decision (July 2020) invalidated the EU-US Privacy Shield, finding that US surveillance programs did not provide adequate protection for EU data subjects and lacked effective judicial redress. This created significant uncertainty for transatlantic data flows and required companies using SCCs to conduct Transfer Impact Assessments (TIA) — evaluating whether the destination country's law (particularly government access) undermines the safeguards. Supplementary measures like encryption, pseudonymization, and split processing may be necessary to bring transfers into compliance. The EU-US Data Privacy Framework (2023) addresses the Schrems II concerns by requiring US companies to self-certify, limiting US government access, and providing a Data Protection Review Court for EU data subject redress.

China's cross-border regime under PIPL requires security assessments by the CAC for transfers exceeding volume thresholds, standard contracts filed with the CAC, or certification by an approved body. "Important data" held by CIIOs cannot be transferred without CAC review and approval. The practical effect is that most cross-border transfers from China require some form of government oversight, creating a significant compliance burden for multinational operations.

The US CLOUD Act (Clarifying Lawful Overseas Use of Data, 2018) addresses the complex question of when US law enforcement can compel production of data stored abroad by US technology companies. It confirms that US warrants apply to data in the possession, custody, or control of a US provider regardless of where the data is physically stored. It also establishes a framework for "executive agreements" between the US and foreign governments, allowing qualifying foreign governments to directly request data from US providers without going through MLAT (Mutual Legal Assistance Treaty) channels, subject to privacy and human rights safeguards.

China's National Intelligence Law (2017) requires organizations and citizens to "support, assist, and cooperate with national intelligence efforts," which has raised concerns in other jurisdictions that Chinese technology companies operating abroad may be compelled to provide data to Chinese intelligence services. This concern contributed to restrictions on Huawei and other Chinese technology firms in several countries and is a factor in data sovereignty debates.

The EU's approach to government access centers on the Schrems II reasoning: US surveillance law (particularly Section 702 FISA and Executive Order 12333) allows collection of foreign communications in ways that EU courts find incompatible with fundamental rights. The EU-US DPF (2023) attempts to address this by limiting US government access to DPF-certified data to "necessary and proportionate" purposes and providing the Data Protection Review Court as a redress mechanism. Whether the DPF survives a future legal challenge (a "Schrems III") remains an open question.

Multi-jurisdictional organizations face genuine conflicts between data sovereignty regimes. Russia requires in-country storage; the US CLOUD Act asserts US jurisdiction over data controlled by US providers regardless of location; China restricts outbound transfers; the EU restricts transfers to jurisdictions without adequate protection. A multinational company with operations in all four jurisdictions may find that compliance with one law places it in tension with another — storing data in Russia to satisfy 152-FZ while simultaneously being subject to US CLOUD Act warrants, or facing EU Schrems II constraints on transferring that same data.

The Schrems II litigation illustrated this conflict: an Austrian privacy activist (Max Schrems) challenged Facebook's transfer of EU personal data to the US, arguing that US surveillance law exposed the data to government access incompatible with EU fundamental rights. The Court of Justice of the EU agreed, invalidating the Privacy Shield and requiring SCC-based transfers to include Transfer Impact Assessments and supplementary measures.

Resolution typically comes through architecture and contractual mechanisms: regional data residency (storing EU data in EU data centers, Chinese data in China, etc.), encryption and split processing to make data unintelligible to government access without user-held keys, SCC and BCR contracts to provide legal safeguards, and adequacy frameworks (like the EU-US DPF) to establish legal certainty. In some cases, organizations must choose between exiting a market or accepting the legal risk of non-compliance with one regime.

Organizations operating across data sovereignty regimes should follow a structured approach. First, classify data by type and jurisdiction: identify personal data, "important data" (under Chinese law), critical data, payment data, and other regulated categories, and map each to the jurisdictions where it is collected, stored, and processed. Payment data and critical infrastructure data are common triggers for localization requirements.

Second, map data flows and applicable laws: document where data is stored, where it is processed, where it is transferred, and who has access — then map each flow to the applicable legal regime (152-FZ for Russian personal data, PIPL/DSL for Chinese data, RBI for Indian payment data, GDPR for EU data, CLOUD Act for US-controlled data). This mapping is the foundation for compliance; flows that are not mapped cannot be assured.

Third, localize where required and use transfer mechanisms where permitted: store Russian personal data in Russia, Chinese important data in China (with CAC approval for transfers), Indian payment data in India, and EU personal data in the EEA or transfer it using SCC, BCR, or adequacy mechanisms with appropriate Transfer Impact Assessments. Consider regional data residency architectures to minimize transfer compliance burden.

Fourth, protect data through encryption, pseudonymization, access controls, audit logging, and transfer impact assessments. Encryption is particularly important as a Schrems II supplementary measure — data encrypted with keys held outside the destination jurisdiction is effectively protected from government access. Monitor legal developments across all applicable jurisdictions, as new mandates, transfer mechanisms, and adequacy decisions emerge regularly.