The cloud sounds like it lives nowhere in particular, but every file you store sits on a physical disk in a real building in a specific country. Where that building is affects how fast your files load, which laws apply to them, and who may be able to compel access to them. For businesses handling customer data, it's often a contractual question as much as a technical one.
Three terms that get mixed up
- Data residency: where your data is physically stored.
- Data sovereignty: which country's laws govern the data, which usually follows where it's stored and where the provider is based.
- Data localization: a legal requirement that certain kinds of data must be stored within a country's borders.
Why location matters
Speed
Data can't travel faster than physics allows. A round trip between India and a data center on the US west coast commonly takes 200 milliseconds or more, while a domestic round trip is often under 50. That difference shows up when you browse folders, preview files and start uploads, and it's more noticeable on slower or mobile connections.
Law and compliance
Rules on personal data differ from country to country. In India, the Digital Personal Data Protection Act, 2023 sets obligations for organizations that handle personal data, and it allows the government to restrict transfers to particular countries. Certain sectors face additional requirements. For example, the Reserve Bank of India has directed that payment system data be stored in India. Businesses in regulated areas should check the rules that apply to them. This isn't legal advice, and the details change, so consult a professional for your situation.
Customer and contract expectations
Larger customers, public bodies and enterprises often ask where their data will be held, and some contracts require it to stay in a given country. Being able to answer clearly is a competitive advantage for a small supplier.
Location isn't the same as security
It's tempting to treat 'hosted in India' as a synonym for 'safe'. It isn't. A server in any country can be poorly protected, and a well-run service elsewhere can be very secure. Residency answers where the data lives. Security answers who can get to it and how well it's protected. You need both questions answered.
Questions to ask any storage provider
- In which country and region are my files stored?
- Are backups and replicas kept in the same country, or copied abroad?
- Which staff or contractors can access my data, and from where?
- Which third-party services process or store my data on your behalf?
- How are files protected in transit and at rest, and who controls the access?
- What happens to my data if I cancel my account, and how quickly is it deleted?
- Can I export all of my files easily if I decide to leave?
- How will I be told if there's a security incident affecting my data?
A practical approach for small businesses
- Classify your data: what's personal, what's confidential, what's public.
- Keep sensitive customer data with providers whose storage location you can verify.
- Record where each type of data is stored, so you can answer a customer or regulator quickly.
- Review the arrangement whenever you change a provider or tool.
Whichever service you're evaluating, NGDS included, put the questions above to the provider directly and get the answers in writing. Where your data lives should be something you can verify, not something you have to take on trust.