What is UK data residency?
Data residency is the physical location where your data is stored and processed; UK data residency means it stays on servers within the United Kingdom rather than being moved abroad.
Data residency is about geography: which country's servers actually hold your data. It matters because the location can determine which laws apply, which authorities could compel access, and whether a transfer abroad triggers extra legal safeguards. For UK organisations handling personal or commercially sensitive information, keeping data close to home is often a contractual or regulatory requirement.
Residency is related to but distinct from data sovereignty. Residency is simply where the data sits; sovereignty concerns whose laws govern it, which can differ from the storage location if the provider is headquartered elsewhere. Knowing both is part of any serious vendor assessment.
Under UK GDPR, moving personal data outside the UK is a 'restricted transfer' that needs a lawful basis such as adequacy or standard contractual clauses. Choosing a provider that keeps primary data in the UK removes much of that complexity, and the remaining question is where its backups and processing sit: transfers to the EU and the wider EEA are covered by the UK's adequacy regulations.
In 99 Data Rooms
How it works here.
99 Data Rooms is UK-hosted in London: primary data is resident in the UK (London) and encrypted backups are held in an EU region, Office-to-PDF conversion runs in AWS Ireland (eu-west-1) and AI drafting runs on Amazon Bedrock in the EU, and international transfers are covered by Standard Contractual Clauses and the UK International Data Transfer Addendum. A Data Processing Agreement is available on request, and there are no advertising or cross-site tracking cookies on your recipients.
Common questions
Data residency, in short.
Residency is where the data is physically stored; sovereignty is whose laws govern it. They usually align, but a provider based abroad could be subject to foreign legal demands even while storing data in the UK, so both are worth checking.
Primary data is resident in the UK (London) and encrypted backups are held in an EU region, encrypted at rest. Office-to-PDF conversion runs in AWS Ireland and AI drafting on Amazon Bedrock in the EU, so if a contract requires every copy and every processing step to stay in the UK, check it against this.
Related terms
What is SOC 2?
SOC 2 is an independent audit report on how a service provider handles data against five trust criteria - security, availability, processing integrity, confidentiality and privacy.
DefinitionWhat is ISO 27001?
ISO 27001 is the international standard for information security management, certifying that an organisation runs a systematic, audited process for identifying and controlling security risks.
DefinitionWhat is a virtual data room?
A virtual data room (VDR) is a secure online space for sharing sensitive business documents with outside parties, where every viewer is controlled and every view is tracked.
Try it on a real document. Turn a PDF into a tracked, revocable link in a couple of minutes. Three rooms stay free for as long as you want them, no card required.