Encryption and access control: these are the most likely answers someone would say when asked about data security methods. Not many would have data localization in mind. After all, it seems counterintuitive to localize data in the age of cloud computing.
However, localizing data is not just a sensible data security method. It is also a must amid the growing aggressiveness and complexity of threats, especially international cybercrimes, and state-sponsored attacks. Also known as data residency, laws have been enacted to compel organizations to localize their data to compel organizations to localize their data.
Data localization: why is it deemed necessary?
Data localization, as the phrase suggests, is the keeping, management, as well as processing of data in a specific location or region. To an extent, it sets geographic boundaries for data, although it does not mean that access will be limited to a specific country or region. It does not mean blocking data from leaving a certain location or completely preventing access from other countries.
Data localization is driven by the concept of data sovereignty Data localization is driven by the concept of data sovereignty, which entails major government involvement. It means that the data of people or entities from a specific country should be under the control or regulation of the same country. Governments or people (represented by their governments) demand control over their data.
Security and privacy are often invoked as the reasons why many countries are moving to localize their citizens’ data collected by apps, websites, and web services. Advocates of localization reason out that their national or local laws should prevail over the handling of their citizens’ data. Weak data protection laws in some countries where data servers are located supposedly endanger their data and can impact national security.
The other major reason why many are pushing for data localization is the economic impact. The global data infrastructure industry is estimated to be worth over $340 billion in 2023 and is projected to grow to over $400 billion by 2027 projected to grow to over $400 billion by 2027. Data infrastructure here includes the physical servers that host the data, data storage media, and network infrastructure (hardware and software). Countries want to partake in this massive industry by having data server businesses operate within their respective jurisdictions.
Another argument in favor of data localization is the low latency or faster access to data for local users. Data is more rapidly accessible to users if they are both in the same country or region. However, this argument is easily countered by the use of content distribution networks (CDNs).
Data Localization vs CDNs
Content distribution networks (CDNs) do not equate to data localization. While they may entail the hosting of data in a country where the data is created, CDNs store multiple copies of data in servers across different parts of the world. They are doing this redundancy to accelerate data delivery to users depending on where they are located. For example, instead of serving data from a server in the USA to users in Japan, the system can direct users to servers in Japan to ensure speedier transmission and the lowest latency.
In other words, CDNs may satisfy the argument of fast data access but they do not address the security, privacy, and economic impact concerns. These three are the bigger reasons fueling the push for data localization.
Criticisms vs data localization
As The New York Times reported in 2022, dozens of countries are already expediting efforts dozens of countries are already expediting efforts to achieve data localization. More than fifty countries are already in the process of introducing laws that force data created by their respective governments, businesses, organizations, and citizens to be stored and managed locally. European Union policymakers seek to put guardrails on data generated within the EU. In India, legislators are working on a law that would restrict the data that can be permitted to leave the country. In the United States, data security and misinformation/foreign propaganda fears are pressuring TikTok to self-enforce data localization for American users.
These may sound positive in view of the benefits mentioned earlier, but there are parties that oppose the recent developments toward data localization. Multinational companies that host tons of data, for example, argue that compulsory localization makes them inefficient. It also entails additional costs for them, as they may be obliged to operate their own servers in the countries they serve or contract local servers to host their data.
Additionally, data localization is perceived as a protectionist policy. It imposes more burden on companies that want to operate in foreign countries, which is contrary to the principles of global free trade. It may disadvantage foreign businesses that seek to enter a market abroad by requiring them to spend more for the storage and handling of their data, which is already a staple for modern organizations.
Businesses nowadays rarely operate without collecting, storing, processing, and analyzing data. The emergence of data localization laws in various countries makes doing business significantly more complicated and costlier. Aside from the added costs of storing data in a specific country, there is also the possibility of conflicting data localization policies. Companies cannot implement across-the-board policies; they need to spend more time and resources adjusting their operations according to what local laws mandate.
Even within the same country, there can be policy issues. Meta, for example, had to suspend the availability of their augmented reality filters suspend the availability of their augmented reality filters to users in Illinois and Texas because of possible violations of laws on biometric data regulation.
Making the case for data localization
While most data localization proponents automatically turn to security and privacy as their main justification, it can be said that economic impact is the most compelling reason why many want to localize their data.
For the longest time, the world’s biggest tech companies have enjoyed the benefits of unregulated data collection and use. They have freely operated across various markets worldwide without being subjected to local laws and taxation regimes. Inversely, some companies took advantage of less expensive server and labor fees in some countries while doing business in their home country, depriving opportunities to (data infrastructure) businesses and workers in their country in the process.
Data localization does not fully solve the imbalance of opportunities created by the status quo. However, it can be a good start. It forces companies to contribute more to the countries where they want to do business. It promotes local industries involved in the data storage infrastructure business. It generates local jobs with data processing compulsorily undertaken locally. Also, it prevents enterprising entities from being cavalier with their data handling like using insecure cheap servers abroad to cut costs.
Is data localization essential for security and privacy?
To be clear, if data security and privacy are the sole concerns, data localization is arguably not necessary. There are existing data security fabric solutions that effectively secure data and workloads in cloud and hybrid settings. Data can be properly secured regardless of location with the right security tools. Encryption solutions, next-generation firewalls, web application firewalls, malware protection, and sophisticated access control systems can be put in place to keep data secure and private.
However, data localization is more than just the need for security and privacy. It is also a strategic move to attempt to rewrite the balance in a world dominated by tech giants that have mastered the utilization of data for profit generation.
So, is data localization a boon or bane? Well, that depends on who you ask.
Image: Depositphotos
Read More
Pratik Dholakiya