NIST Privacy Framework, Identify-PID.IM-P7

Keep a copy of any personal data transferred to a third country or an international organisation in Botswana for the period of processing.

Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.

Host or replicate any registry, file, archive, or database containing personal data in electronic form only on servers located within Cuba's national territory, absent a case the law provides for.

Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.

Store personal data collected or obtained in Ethiopia on a server or data center located in Ethiopia, and keep any category of critical personal data the Authority prescribes on a server or data center there.

Check whether the Cabinet Secretary has designated your category of processing for mandatory handling on a server or data centre located in Kenya.

Record, systematize, accumulate, store, update, and retrieve personal data of Russian citizens in a database physically located in Russia, whether you act as operator or processor, under Federal Law No. 152-FZ Article 18(5) as amended by Federal Law No. 23-FZ.

Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.

An app storing or processing the personal data of individuals in Tajikistan, including a voiceprint or other biometric identifier, must by default keep the database exclusively inside Tajikistan, unless it has an arrangement agreed with the authorized state body for personal data protection. Transferring that data abroad separately requires the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.

Beginning 1 January 2028, if you operate a medical facility or genomic research facility, do not store Utah genetic-sequencing data within the territory of a designated foreign adversary, and do not use a genetic sequencer or sequencing software that is a final product of a foreign adversary.

Obtain the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymize the data before transmission wherever the research's purpose allows it, and host any health data that still permits identification on national territory.

As a consumer reporting agency, adopt all procedures reasonable for ensuring accuracy and fairness in your consumer reports, report only information extracted from files stored or collected in a repository located in Canada, and leave out the items section 9 forbids, including race, creed, colour, sex, ancestry, ethnic origin and political affiliation and most adverse items more than seven years old.