<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-data-residency-requirements
description: >-
  Audit data residency and sovereignty requirements across jurisdictions
  including GDPR data transfer mechanisms, data localization laws, cloud
  region validation, and cross-border data flow mapping with automated checks.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - data-residency
  - data-sovereignty
  - gdpr
  - data-localization
  - cross-border
  - privacy
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing Data Residency Requirements

## Overview

Data residency requirements mandate where data is stored and processed based on
jurisdiction-specific regulations. This skill automates validation of cloud resource
locations, cross-border data flow mapping, and compliance with GDPR transfer
mechanisms, data localization laws, and sovereignty requirements.

Mode: `[MODE: PRIVACY]` — Data flow analysis; `[MODE: BLUE]` — Technical validation.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS/GCP/Azure CLI | Required |
| OPA (`brew install opa`) | Required |
| `jq` for JSON processing | Required |

## Key Concepts

### Data Residency Regulatory Landscape

```
Key Data Residency/Localization Laws:
├── European Union (GDPR)
│   ├── Art. 44-49: Restrictions on international data transfers
│   ├── Adequacy decisions (Art. 45): US (DPF), UK, Japan, etc.
│   ├── SCCs (Art. 46): Standard Contractual Clauses
│   ├── BCRs (Art. 47): Binding Corporate Rules
│   └── Schrems II: Transfer impact assessments required
├── China (PIPL + DSL)
│   ├── Personal data: localization required for CIIOs
│   ├── Cross-border: security assessment by CAC for sensitive data
│   └── Data classification: core, important, general
├── Russia (Federal Law 242-FZ)
│   ├── Russian citizens' personal data: stored in Russia
│   └── Cross-border transfer: notification to Roskomnadzor
├── India (DPDP Act 2023)
│   ├── Government may restrict transfer to specific countries
│   └── Significant data fiduciary: additional obligations
├── Brazil (LGPD)
│   ├── Art. 33: International transfer conditions
│   └── Adequacy, SCCs, BCRs, or specific consent
└── Industry-Specific
    ├── Financial: APRA CPS 234 (Australia), MAS TRM (Singapore)
    ├── Healthcare: HIPAA (US), provincial laws (Canada)
    └── Government: FedRAMP (US), IRAP (Australia), C5 (Germany)
```

### Cloud Resource Location Validation

```bash
# AWS: Check S3 bucket regions
aws s3api list-buckets --output json | \
  jq -r '.Buckets[].Name' | while read bucket; do
    region=$(aws s3api get-bucket-location --bucket "$bucket" \
      --output text 2>/dev/null)
    echo "$bucket: ${region:-us-east-1}"
  done

# AWS: Check RDS instance regions
aws rds describe-db-instances --output json | \
  jq '.DBInstances[] | {id: .DBInstanceIdentifier, region: .AvailabilityZone}'

# AWS: Check all resources in non-approved regions
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  count=$(aws ec2 describe-instances --region "$region" \
    --query 'Reservations[].Instances[] | length(@)' --output text 2>/dev/null)
  [ "$count" -gt 0 ] && echo "ALERT: $count instances in $region"
done

# GCP: Check resource locations
gcloud compute instances list --format="table(name,zone)" 2>/dev/null
gcloud storage buckets list --format="table(name,location)" 2>/dev/null
```

### OPA Data Residency Policy

```rego
# policy/data_residency.rego
package compliance.data_residency

approved_regions := {"eu-west-1", "eu-west-2", "eu-central-1"}

deny[msg] {
    resource := input.resources[_]
    not resource.region in approved_regions
    msg := sprintf("Resource %v in non-approved region %v (approved: %v)",
        [resource.id, resource.region, approved_regions])
}

deny[msg] {
    bucket := input.s3_buckets[_]
    not bucket.region in approved_regions
    bucket.contains_pii
    msg := sprintf("S3 bucket %v contains PII in non-EU region %v",
        [bucket.name, bucket.region])
}

deny[msg] {
    transfer := input.data_transfers[_]
    transfer.destination_country != "EU"
    not transfer.transfer_mechanism
    msg := sprintf("Cross-border transfer to %v lacks legal mechanism",
        [transfer.destination_country])
}
```

## Workflow

### Step 1: Map Cloud Resource Locations

```bash
node scripts/agent.js --action inventory --cloud aws \
  --output /tmp/residency-inventory.json
```

### Step 2: Validate Against Residency Policy

```bash
node scripts/agent.js --action validate --input /tmp/residency-inventory.json \
  --approved-regions eu-west-1,eu-central-1 --output /tmp/residency-check.json
```

### Step 3: Generate Transfer Impact Assessment

```bash
node scripts/agent.js --action tia --input /tmp/residency-check.json \
  --output /tmp/transfer-impact.json
```

## Verification

- [ ] Cloud resource inventory includes all regions with data presence
- [ ] PII/sensitive data locations mapped to jurisdictional requirements
- [ ] Non-approved region resources flagged with remediation plan
- [ ] Cross-border transfers documented with legal mechanisms (SCC/BCR/adequacy)
- [ ] Transfer Impact Assessment completed for high-risk transfers
- [ ] Data residency policy enforced via OPA in deployment pipeline
- [ ] Monitoring alerts on resource creation in non-approved regions

## References

- [GDPR Chapter V — Data Transfers](https://gdpr.eu/tag/chapter-5/)
- [EU SCCs](https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
- [EDPB Guidelines on Data Transfers](https://edpb.europa.eu/)
