NIST Privacy Framework, Identify-PID.IM-P7

Keep a copy of any personal data transferred to a third country or an international organisation in Botswana for the period of processing.

Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.

Host or replicate any registry, file, archive, or database containing personal data in electronic form only on servers located within Cuba's national territory, absent a case the law provides for.

Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.

Store personal data collected or obtained in Ethiopia on a server or data center located in Ethiopia, and keep any category of critical personal data the Authority prescribes on a server or data center there.

An app storing or processing the personal data of individuals in Kazakhstan, including a voiceprint or other biometric identifier, must maintain a database located within Kazakhstan; Kazakhstani law does not on its own text forbid an additional copy abroad. Transferring that data to another country requires that the destination state ensure equivalent protection, or one of four fallback grounds: the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.

Check whether the Cabinet Secretary has designated your category of processing for mandatory handling on a server or data centre located in Kenya.

Record, systematize, accumulate, store, update, and retrieve personal data of Russian citizens in a database physically located in Russia, whether you act as operator or processor, under Federal Law No. 152-FZ Article 18(5) as amended by Federal Law No. 23-FZ.

Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.

An app storing or processing the personal data of individuals in Tajikistan, including a voiceprint or other biometric identifier, must by default keep the database exclusively inside Tajikistan, unless it has an arrangement agreed with the authorized state body for personal data protection. Transferring that data abroad separately requires the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.

An app is not exempt from Kazakhstan's Law on Personal Data merely because biometric data has no dedicated definition in the Act. Collecting biometric data in a public place for identification purposes is restricted to constitutional-order, public-order, rights, health, or morality grounds unless the subject consents, and biometric data stored on Kazakhstani subjects must sit in a database located inside Kazakhstan like any other personal data. Confidentiality of biometric data specifically is deferred to other Kazakh legislation, which the Act does not name and which is not identified here.

Obtain the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymize the data before transmission wherever the research's purpose allows it, and host any health data that still permits identification on national territory.