“It's our data. We can leave whenever we want.”
Monday's renewal meeting has reached the confident nodding stage. Hana, Sandline's finance controller, pauses. Can they get the records back, read the files and work elsewhere?
That's why data residency vs data sovereignty matters. Location, law and rights need separate answers. Let's see what to ask, what to test, and how it applies to Beezr.
Data residency vs data sovereignty: what's the difference?
Data residency is where data is stored or processed. Data sovereignty concerns the legal powers and duties that affect it. Data ownership concerns each party's rights and duties.
Think of a rented storeroom. The address tells you where boxes sit. The contract sets rights; the law can impose duties on both parties.
Your name on a box doesn't tell you who can open it. Or how you'll collect it when the deal ends.
| Term | The useful question | What it doesn't settle |
|---|---|---|
| Residency | Where are the relevant copies stored or processed? | Who may access them or which obligations apply |
| Sovereignty | Which authorities and legal requirements affect the processing? | Whether your configuration actually enforces the required controls |
| Ownership | What rights and responsibilities does each party have? | Whether you can retrieve usable data and operate after leaving |
Personal data isn't just property in a box. The Saudi PDPL sets out rights for the person it concerns. It distinguishes that person from the controller and processor.
The controller decides why and how to process it. The processor acts for the controller. “We own it” doesn't mean “we may do anything with it”.
What data residency requirements should you check?
Storage is only one part of the legal question. Saudi law covers processing in the Kingdom.
Article 2 also covers firms outside it that process data about people living there. See the law's scope.
Follow one record. Where does an integration send it?
What ends up in reports? What reaches an AI provider?
Follow the record before asking about the law
- Hana, Finance Name the data — separate order details from personal contacts and payment information.
- Karim, Systems Map its route — list the app, database, connected services and exports.
- Responsible adviser Check the duties — assess law, contract and sector rules for that map.
- Layla, Operations Assign the controls — name who sets access, approves changes and checks exit proof.
Bring one key process, with enough detail to avoid the wrong answer. You needn't map every legal issue to have a useful meeting.
This country overview is not legal advice. Each law has cases it leaves out.
It also has rules to put it into practice and rules for sectors. Check current texts with a qualified adviser.
| Jurisdiction | Primary source and overview | Question to take to your adviser |
|---|---|---|
| UAE | Federal Decree-Law No. 45 of 2021 addresses personal data protection. Articles 22 and 23 set when personal data may leave the UAE, depending on whether the destination offers adequate protection. Free zones with their own data-protection regimes, and some regulated sectors, follow separate rules. | Which regime covers this processing, and which conditions apply to each proposed transfer? |
| Saudi Arabia | The PDPL and transfer regulation address protection and conditions for transfers outside the Kingdom. The regulation covers adequacy assessments and appropriate safeguards such as standard contractual clauses. | Which transfer route and safeguards fit this data flow, including onward processing? |
| Egypt | Law No. 151 of 2020, as described by the State Information Service, concerns personal data of natural persons processed electronically, in whole or in part, and lists some exclusions. | What do the current law and implementing rules require for this processing and its service providers? |
This doesn't mean all business data must stay in-country. Nor does one hosting choice settle compliance. Give your adviser the actual data map.
What is Beezr's Sovereignty Stack?
The Sovereignty Stack is Beezr's model, not a legal standard. It turns a promise of control into seven questions.
The Sovereignty Stack: Beezr's buyer model
- Location — where is data stored and processed?
- Jurisdiction — which duties and responsible legal parties apply?
- Access — who can read or change which records?
- Keys — who manages encryption, and under which terms?
- Portability and exports — what usable data can you get back?
- Backups — who restores data, and what proves it works?
- Exit — who helps you move, and what work remains?
An encryption answer won't fill a recovery gap. An export feature won't tell you the moving cost. Work through each row.
| Layer | Ask the vendor | Evidence to request |
|---|---|---|
| Location | Which components hold or process this data, including connected services? | A data-flow description and contractual allocation of responsibilities |
| Jurisdiction | Which legal entities provide and process the service? | Relevant contract terms and a list of processing parties for legal review |
| Access | Who administers access, and can business roles be tested separately? | A demonstration using the roles your process actually needs |
| Keys | Who can administer keys, use them and revoke access? | Documented custody and recovery responsibilities |
| Portability | What can we export, and how are relationships understood? | A sample export inspected by the intended receiving team |
| Backups | Who is responsible for recovery, and how is restoration verified? | Recovery responsibilities and evidence of a restoration exercise |
| Exit | Who does what when we leave, and how are remaining copies handled? | A written exit process, deliverables and a migration test |
A blank is a question, not “probably included”. Give it an owner. Decide which proof you need before signing.
How do Beezr's deployment choices fit?
Apply the same questions to us. Your adviser assesses whether a given setup meets the law. Start with our deployment page.
| Layer | Evidence-backed Beezr answer | What you still need to establish |
|---|---|---|
| Location | Managed cloud runs on AWS. In your-own-database mode, business records live in your database and Beezr keeps the application's configuration. Self-hosted is delivered as a Docker image inside your environment. | The full data-flow map for your chosen arrangement and connected services |
| Jurisdiction | The three deployment options let you place the platform and your records differently. Legal obligations come from your own contract and the laws that apply to you. | Contracting and processing parties, applicable obligations and required terms |
| Access | Permission profiles narrow access at application, module, record and field levels. Roles carry a permission profile. | Your role design and privileged-operation responsibilities |
| Keys | Sensitive fields can use field encryption. It requires workspace setup; you choose an active key on the field. | Key custody, recovery and administration responsibilities for your arrangement |
| Portability | Export any list to an Excel file, plus a full SQL dump on request. List exports follow active filters and are prepared and emailed to a chosen address. | Required scope, receiving-system compatibility and anything needed beyond those exports |
| Backups | Agree backup and recovery responsibilities for your chosen arrangement in the contract. | Who is responsible for recovery, and the evidence you require before relying on it |
| Exit | The documented extraction routes give you a starting point. | Migration work, responsibilities and how the replacement process will function |
Managed cloud runs on AWS; Beezr runs the platform. Clarify which tasks stay with you.
With your own database, Beezr still runs the platform. Your database holds the business records. Beezr keeps the setup for the app.
Supported choices are MariaDB, PostgreSQL, MySQL, SQL Server and Oracle. Self-hosted puts a Docker image inside your environment. Establish who will run it.
You build and run the same apps across all three choices. See Beezr deployment options. Each choice still needs the full worksheet review.
Sandline · example
Hana tests access, then tests an exit
Hana and Karim build a Quotes module in Beezr. Sara can edit quote inputs; the approver sees those fields read-only. A discount needing review goes through workflow approval.
Those rights come from profiles and approval steps. Owning the database doesn't assign them.
Hana exports a filtered quote list to Excel. She checks that the filter matches her intent. Karim asks what the next system needs to rebuild the process.
He requests the full SQL dump as another extraction route. Hana lists the work between “we got the file” and “we can use it”. That goes in the exit estimate.
How Beezr does it
Follow the AI step too. Beezr's AI workflow step sends instructions and what it reads to your chosen provider. It uses your account. Put that route beside the database on your map; see how the AI step works.
Does an export mean you can leave without work?
A moving box full of papers isn't a working office. Getting data out and rebuilding work are separate jobs.
Ask the receiving team to inspect a sample. Which keys, links and documents does it need?
How must the process be defined? Check each against the documented export scope.
The UK government's TCO checklist includes exit and transition in lifetime costs. Put that work in the ownership calculator. Don't give exit a convenient zero.
Choose for the requirement you actually have
- If the whole platform must be inside your environment → assess self-hosting — agree who runs it.
- If business records must live in your database → assess that option — map configuration and outside processing too.
- If managed operation fits → assess managed cloud — check access, recovery and exit.
- If a required answer is missing → resolve it before signing — a label isn't proof.
Myth / Reality
“Self-hosted settles sovereignty.” It describes where the platform runs. Still check law, access, connected services, recovery and exit. Use the same worksheet.
Our take
Our take. Test leaving while everyone is still glad to meet. It helps both sides get clear on who does what.
Key takeaways
- If you're technical: map where data goes. Check export scope with the team receiving it.
- If you're not: ask where data sits, which duties apply and what you can do with it. Record open questions.
- Hosting choices inform the legal and working assessment.
- A file proves extraction. Test what you can do next.
Your deployment options in Beezr
Bring one process to make the choice concrete.
- Choose where to run it — managed AWS cloud, your database, or self-hosted Docker inside your environment.
- Set access — profiles for apps, modules, records and fields.
- Encrypt sensitive fields — arrange workspace setup, then choose an active key per field.
- Inspect exports — any list to Excel; a full SQL dump on request. Check active list filters before exporting.
Questions readers ask
What does data sovereignty mean, in simple terms?
It asks which legal powers and duties affect data. When buying, use Beezr's Sovereignty Stack to ask more. Check access, keys, exports, restoring data and how to leave.
Is data residency the same as data ownership?
No. Residency asks where; ownership asks about rights and duties. Neither alone proves you can get usable data back and move.
What does data sovereignty mean for a UAE business?
First find which regime covers the actual processing. The federal law on personal data sets rules for sending it abroad. Ask an adviser which rules and conditions apply to your map.
What are my software's data residency requirements?
They depend on processing and the duties that apply. Tell your adviser what kinds of data you use and who processes it.
List connected services and what your contract requires. This guide gives questions, not permission to deploy.
Can business records stay in our own database with Beezr?
Yes. Your business records live there.
Beezr keeps the setup for the app. See the database choices above. Confirm the full setup, connected-service flows and who runs each part.
Sandline Supplies is a fictional example company.
Sources
- Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data · UAE Legislation · 2021
- United Arab Emirates Allows Cross-Border Data Flows of Personal Data · U.S. International Trade Administration · undated
- Personal Data Protection Law · SDAIA · Undated consolidated text; accessed 2026-10-17
- Regulation on Personal Data Transfer Outside the Kingdom · SDAIA · Undated; accessed 2026-10-17
- Ratification of the Personal Data Protection Law · Egypt State Information Service · 2020-07-18
- Total Cost of Ownership: Things to Consider · UK Government, HMG ICT Strategy · 2011-10-27