2017
While European organizations were focused on GDPR preparation, a parallel but distinct data governance challenge was accelerating globally: data localization mandates. Russia, China, Indonesia, Vietnam, and India all moved in 2016-2018 to require that certain categories of data about their citizens be stored and processed domestically.
Unlike GDPR's restrictions on data transfers from the EU, localization mandates required active presence — physical servers, data centers, or cloud regions within the country. For multinationals operating across these markets, the compliance implications were significant and the cost material.
Russia's Personal Data Localization Law
Russia's Federal Law No. 242-FZ, which took effect in September 2015 but began serious enforcement in 2016-2017, required that Russian citizens' personal data be stored on servers physically located in Russia. This included any personal data about Russian citizens, regardless of where the company collecting it was headquartered.
The practical impact on international businesses operating in Russia was significant. Companies using US or European cloud providers for their CRM, HR, and e-commerce platforms had to either establish Russian data infrastructure or migrate Russian customer data to compliant locations. LinkedIn's refusal to comply resulted in the platform being blocked in Russia in 2016.
Russian cloud providers — Yandex.Cloud, SberCloud, Mail.ru Cloud — benefited from the mandate, as multinationals established Russian cloud infrastructure to maintain market access. The enforcement mechanism — Roskomnadzor's ability to block non-compliant services — created genuine commercial pressure to comply.
China's Cybersecurity Law and Data Localization
China's Cybersecurity Law, which came into full effect in June 2017, required that data collected by critical information infrastructure operators (CIIOs) be stored in China. The definition of CIIO was broad and evolving, creating uncertainty for multinationals across sectors.
Subsequent regulations — the Data Security Law (2021) and Personal Information Protection Law (2021) — expanded China's data governance requirements significantly. Taken together, China built one of the world's most comprehensive data localization regimes, requiring that virtually all significant data about Chinese citizens, customers, or operations be stored domestically.
Cross-border data transfers from China required security assessments for large volumes of personal data or important data, standard contractual clauses with Chinese characteristics, and in some cases government approval. The compliance burden for multinationals was substantial.
India's Data Protection Journey
India's data localization journey was longer and more contested. The 2018 Reserve Bank of India directive requiring payment data to be stored exclusively in India was one of the first concrete mandates, affecting payments companies including Mastercard, Visa, and American Express.
The broader Personal Data Protection Bill went through multiple drafts and significant political negotiation before the Digital Personal Data Protection Act was passed in 2023. India's final framework was less restrictive on localization than earlier drafts had suggested — most personal data could flow internationally with appropriate consent or contractual protections — but payment and some sensitive data categories retained localization requirements.
India's evolution demonstrated that data localization mandates were politically contested, not inevitable. The tension between sovereignty interests and the desire to remain integrated in the global digital economy created compromise frameworks that were less restrictive than feared.
The Operational Challenge for Multinationals
Multinationals operating across Russia, China, India, and the EU simultaneously faced a fragmented data governance landscape with conflicting requirements. Data that GDPR required to stay in the EU might also need to be localized in Russia for Russian citizens or in China for Chinese nationals.
The architectural response was data segmentation at the country level: separate data infrastructure for each jurisdiction, with strict data classification to ensure citizen data stayed in the appropriate country. This approach was expensive — separate cloud regions in each country, separate data management processes, separate security infrastructure — but was often the only compliant path.
Global ERP and CRM platforms had to support multi-region data architectures. Salesforce, SAP, Oracle, and Microsoft all built capabilities to segregate data by jurisdiction, enabling multinationals to maintain customer data locally while still having global system access for their operational users.
The Outpace Approach: Multi-Jurisdiction Data Architecture
At Outpace, we help multinational clients navigate data localization requirements across jurisdictions. The starting point is always a data flow mapping exercise — understanding what data about which nationals flows where, and identifying compliance gaps against each jurisdiction's requirements.
We design data architectures that satisfy localization requirements without duplicating entire system stacks: using cloud providers' regional data residency options, configuring ERP and CRM to segregate data by jurisdiction, and building the operational processes that maintain compliance as data flows change.
For Odoo deployments at multinational clients, we configure data residency at the module and record level, enabling Russian customer data to be stored in Russian-hosted infrastructure while the rest of the operational data resides in the primary deployment location.
Moving Forward: Localization Is Spreading
Data localization mandates have spread beyond the early movers. By 2024, more than 100 countries had some form of data localization requirement. The trend is toward more requirements, not fewer.
Multinationals that build data architectures for localization compliance now create durable infrastructure that can accommodate new country requirements as they emerge. Those that treat each new mandate as a one-off compliance project face recurring disruption.
💡 Ready to build a multi-jurisdiction data architecture that handles localization mandates across your operating countries? Outpace Professional Services designs compliance-first data infrastructure. Contact us for a jurisdiction assessment.
