Data Residency vs Data Sovereignty: Are Businesses Confusing the Two?

Often, yes. Data residency is about where data physically sits. Data sovereignty is about whose laws apply to it and who can compel access. A cloud provider can offer a Singapore storage region, which is residency. If that provider is headquartered in the United States, US law can still require it to produce the data, which is a sovereignty question. With AI there is a third layer that both terms tend to skip: where your prompts are actually processed. As of 5 Nov 2026, OpenAI offers Singapore storage at rest but lists regional processing only in the US, Europe and the UAE. Knowing which of the three layers you need prevents both overspending and false comfort.

What do residency, sovereignty and localisation actually mean?

IBM's definitions are a clear starting point:

• Data residency "refers to the geographical location of data".
• Data sovereignty "is the concept that data is subject to the laws of the country or region where it is generated or processed".
• Data localisation "refers to legal requirements to keep data where it was created".

Residency is a fact about infrastructure. Localisation is a legal requirement that some countries or sectors impose. Sovereignty is about legal reach, and it depends as much on who operates the infrastructure as on where it is.

Why can data stored in Singapore still be reached from abroad?

Because laws apply to companies as well as places. The US CLOUD Act (18 U.S.C. §2713, enacted 23 Mar 2018) requires US providers to disclose communications and records in their "possession, custody, or control", regardless of whether the data is located inside or outside the United States. The US Department of Justice lists executive agreements under the Act with the UK and Australia; Singapore is not listed.

The EU took a different approach. Article 48 of the GDPR says a foreign court order to transfer personal data "may only be recognised or enforceable in any manner if based on an international agreement". Singapore's PDPA regulates transfers of personal data out of Singapore by organisations through its Transfer Limitation Obligation. As we read it, it does not contain an equivalent of Article 48. So Singapore storage with a US provider gives you residency, but the provider's home jurisdiction still applies.

Residency answers "where is it?" Sovereignty answers "whose law reaches it?" For AI, add a third question: "where is it processed?"

Where do the major AI services process Singapore customers' prompts?

This is where AI differs from ordinary cloud storage. A document can rest in Singapore while every question you ask about it is answered by servers elsewhere.

Sources: OpenAI "Your data" guide and data residency announcement; Anthropic data residency docs; Google Cloud data residency docs (updated 3 Nov 2026) and Workspace updates blog (9 Jun 2025); Microsoft 365 Copilot privacy page (updated 3 Nov 2026) and Microsoft 365 blog. All accessed 5 Nov 2026. Options change often, so check the vendor pages.

All four vendors also state that business customers' data is not used for training by default. Residency and sovereignty are separate from that question.

Which one does your business actually need?

It depends on what the requirement says, and businesses often over- or under-buy because they don't read it closely:

• "Data must be stored in Singapore." That is residency. A cloud service with a Singapore storage region may satisfy it, but check whether processing counts too.
• "Personal data may only leave Singapore with comparable protection." That is the PDPA's Transfer Limitation Obligation. Contracts or certifications such as APEC CBPR can meet it, so overseas processing is not automatically ruled out.
• "No third party may access client data." That is a confidentiality or sovereignty requirement. A foreign provider's legal exposure becomes relevant, and so does where processing happens.
• "The data must never leave our control." Only processing on infrastructure you operate meets this fully.

Financial institutions should also consider Banking Act section 47 and MAS outsourcing requirements; our post on confidential financial data and public AI models covers them.

Does self-hosting give you full sovereignty?

It gives you the most control available, with caveats. Running an open-weight model on a system such as the NVIDIA DGX Station GB300 keeps storage, processing and administration in your premises, under Singapore law and your own policies. Its 748GB of coherent memory is enough for large open models without sending a single prompt outside.

But sovereignty over data is not the same as compliance. The PDPA's Protection Obligation still requires reasonable security arrangements. A breach affecting 500 or more people is still notifiable, with the PDPC informed no later than three calendar days after you assess it. You also depend on the people running the system. See why a DGX Station can be a single point of failure and whether it should be connected to the internet.

A quick self-check

1. For each AI service in use, write down where prompts are stored and where they are processed.
2. Note the provider's headquarters and which country's laws can compel it to disclose data.
3. Read your contracts, client terms and sector rules for the exact wording: storage, processing, transfer or access.
4. Match each workload to the layer it needs. Use cloud AI where residency or contracts are enough. Use local infrastructure where processing or third-party access must be excluded.

For the broader argument, read Sovereign AI: Why Should Your Company's Intelligence Live on Someone Else's Server? and why Singapore businesses should consider running AI locally. For staff behaviour, see where company data goes when using AI.

Buying in Singapore

If some workloads must stay on infrastructure you control, SourceIT supplies DGX Station GB300 systems from HP, MSI, ASUS, GIGABYTE and Supermicro, all price on request. Smaller teams can start with the NVIDIA DGX Spark 4TB at S$9,300 (listed 5 Nov 2026). See the AI workstations and servers collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is the difference between data residency and data sovereignty? Residency is the physical location of data. Sovereignty is about which country's laws apply to that data and who can legally compel access to it.

If my AI provider stores data in Singapore, is it processed in Singapore? Not necessarily. OpenAI, for example, offers Singapore storage at rest but lists regional processing only in the US, Europe and the UAE, as of 5 Nov 2026.

Can US authorities access data stored in Singapore? If a US provider holds it, the US CLOUD Act requires the provider to disclose data in its possession, custody or control regardless of where it is stored, subject to the legal process involved.

Does the PDPA require data to stay in Singapore? No. It allows transfers abroad if the recipient provides comparable protection, for example through contracts or recognised certifications. Some sectors and contracts are stricter.

Is a self-hosted AI model automatically compliant? No. Self-hosting addresses where data is processed, but security, breach notification, access control and sector rules still apply to the system you run.