For most of the internet's history, where data physically sat was an implementation detail. The appeal of cloud computing was that location stopped mattering. Governments have spent a decade deciding that it does.

What is the difference between data residency and data localisation?

Residency is the narrower requirement: certain categories of information must be stored inside a country's borders. Health, tax, government and financial records are the usual candidates, and it is relatively simple to satisfy.

Localisation goes further, requiring that the data also be processed locally, and sometimes that no copy leaves the country. That is considerably harder, because backups, analytics, fraud detection and support access all cross borders by default.

Two further requirements sit behind them. Jurisdictional control concerns which country's courts can compel access, and a file stored in one country but operated by a company headquartered in another may be reachable by the second country's legal system. Operational sovereignty covers who can physically or administratively reach the systems, sometimes requiring local citizenship or clearance.

Why did these rules spread so quickly?

Four forces converged. Privacy regulation came first: Europe's framework restricted transfers to countries lacking adequate protection, and dozens of countries followed with similar rules. Legal conflict came second, as disputes over data held abroad showed that storage location and legal reach are separate questions.

Industrial policy came third, and is usually unstated: requiring domestic storage creates demand for domestic infrastructure and employment. Geopolitics came fourth, as governments grew less comfortable with critical national information sitting on infrastructure controlled elsewhere.

What does compliance require in practice?

More than choosing a location. The primary copy sits in the required jurisdiction, and so must the backups, which is frequently missed since disaster recovery is traditionally placed deliberately far away. That means two facilities in one country, separated enough to survive a regional event but both inside the border.

If processing must be local, then analytics and machine learning run locally too, which means compute rather than storage. Administrative access has to be logged, because an engineer reaching a system from abroad may count as a transfer even if nothing is copied.

Why do sovereignty rules drive data center construction?

Because they break the economics of consolidation. Before these rules, a provider could serve a whole region from a few very large facilities, which is by far the most efficient arrangement. A region servable from three sites may now need eight or twelve.

Those facilities are often smaller, frequently built in markets that would not attract investment on commercial grounds alone, and relatively insensitive to price. An organisation that must store data locally will pay what local capacity costs.

Where does Latin America stand?

Brazil, Mexico, Colombia, Chile, Argentina, Uruguay and Panama have all enacted or strengthened privacy legislation, with sector rules for finance, health and government often stricter than the general regime.

The difficulty has been less about rules than capacity. An organisation required to keep data in a country without meaningful capacity has an obligation and nowhere to satisfy it.

Cloud computing was sold on the idea that location no longer mattered. Regulation has spent a decade deciding that it does.