Data residency

Residency, sovereignty, localisation

Three terms that procurement documents use loosely and that mean different things.

• Residency — where the data physically sits at rest. A factual, checkable property: which region, which data centre.
• Sovereignty — whose law can compel access to it. This follows the supplier's corporate structure and the location of the people who administer the system, not only the location of the disk.
• Localisation — a legal requirement that data must not leave a jurisdiction at all. Rare in the UK; common in some other countries.

A supplier storing data in London while operating from elsewhere gives you UK residency and something less than UK sovereignty. That is not automatically a problem — it is a thing to state accurately in your DPIA rather than to blur.

What UK GDPR actually requires

UK GDPR does not require personal data to stay in the UK. It restricts transfers to third countries unless a safeguard applies — an adequacy regulation, or a transfer mechanism such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, plus a transfer risk assessment where relevant.

So residency is not a legal requirement so much as a way of removing a question. If the data never leaves the UK, there is no transfer to assess, no mechanism to paper and no adequacy decision to depend on. That is why UK public sector buyers ask about it early: it is the shortest path through the part of the form nobody enjoys.

The questions worth asking a supplier

1. Which region are the database and the file storage in, specifically?
2. Where are backups stored, and for how long?
3. Which sub-processors touch the data, and where are they?
4. Can support staff outside the UK access production data, and under what controls?
5. Does any analytics, logging or email service receive personal data?

A supplier who answers "we're UK-hosted" and cannot answer questions two to five has told you about one disk.

A worked example

A council runs a consultation. The responses live in a UK region: no transfer to assess. But the consultation link was distributed by an email platform in the United States, and the email addresses are personal data. Residency of the survey responses did not make the transfer question go away — it moved it to a different system, which is where the DPIA has to look.

In NumoForms

Survey content and responses are stored on Supabase in the London region (eu-west-2), so survey data stays in the United Kingdom. Data is encrypted in transit with TLS and at rest with AES-256 by the platform, and uploaded files sit in a private bucket that is read through short-lived signed URLs rather than public links.

The full sub-processor list is published on the sub-processors page so you can answer question three above without a support ticket. Related: DPIA for the assessment itself, anonymous survey for the option of not collecting personal data in the first place, and the security page for the controls, stated without the certification claims we have not earned.