Data Localization: Policymaking or Gambling?

Nikita Melashchenko · Good Data · (2019) · chapter · source ↗︎

Data localisation policies have emerged as a response to the challenges posed by an increasingly data-dependent society. This chapter critically examines the dual role of such policies—as instruments of state control over data flows and as potential regulatory gambles with significant economic, legal, and technological consequences. By outlining the core principles underpinning data localisation within the context of international trade, privacy protection and national security, the analysis highlights the diverse approaches adopted by states—from broad mandates requiring comprehensive onshore data storage to more selective, narrowly tailored measures. The chapter employs a mapping tool to evaluate how these varying regulatory designs impact information management cycles, thereby affecting social welfare and market efficiency. Ultimately, the study argues that while data localisation can enhance data sovereignty and privacy, its effectiveness is contingent upon the clarity and proportionality of its design. Without a nuanced approach that balances competing societal values, localisation measures risk creating legal uncertainty and unintended barriers to global data flows, transforming a potentially strategic policy instrument into a precarious gamble.

Key points

• Data localisation policies are not a monolithic category but exist on a regulatory spectrum, ranging from comprehensive onshore storage mandates (broad or horizontal measures requiring all personal data to be stored domestically) to narrowly scoped sectoral requirements targeting specific data types or industries; this architectural choice determines regulatory effectiveness, trade law compatibility and social welfare impacts.

• Three foundational rationales drive data localisation adoption. These are international trade competitiveness, privacy and personal data protection, and national security. But these rationales frequently point toward conflicting regulatory designs: privacy justifications favour granular, rights-based approaches, while security rationales push toward sweeping sovereign-internet measures, making it structurally difficult to optimise for all three simultaneously.

• The chapter introduces an information management cycle as a mapping tool, a systematic framework for tracing how data localisation requirements interact with each stage of data creation, processing, storage, transfer and deletion, enabling structured proportionality analysis across divergent regulatory designs rather than abstract policy comparison.

• Broad localisation mandates (exemplified by Russia’s Federal Law No. 242-FZ, which required domestic storage of all personal data of Russian users from September 2015) impose substantial compliance costs on foreign operators, restrict access to global cloud infrastructure and scale economies, and displace the burden of regulatory legitimacy onto enforcement mechanisms that remain underdeveloped. Essentially trading stated sovereignty gains for market fragmentation and legal unpredictability.

• The “gambling” diagnosis captures the core design failure. Data localisation measures adopted without clearly defined scope, trigger conditions, or exemption frameworks produce legal uncertainty that is damaging both to regulated entities and to the stated policy objective. The regulatory intervention becomes an unpredictable variable rather than a strategic instrument.

• The effectiveness of a data localisation measure is contingent on three design qualities. These are clarity of the trigger (which data, which processing operations, which actors are covered), proportionality of the scope (does the breadth of the obligation match the stated policy end?), and the adequacy of enforcement infrastructure. Most existing measures satisfy these conditions only partially, if at all.

• Absent a nuanced, proportionality-calibrated design, data localisation risks becoming a precarious gamble. States substitute illusory data sovereignty for genuine policy outcomes while simultaneously constructing unintended barriers to cross-border data flows that reduce participation in the global digital economy.