Cloud Data Residency Compliance Checker
Evaluate your cloud data residency compliance posture across regulatory frameworks (GDPR, CCPA, HIPAA, PDPA) by scoring data classification, storage geography, transfer mechanisms, and governance controls.
Fill in all fields and click Check Compliance.
Formula
Compliance Score (CS) = [ R×0.35 + T×0.30 + G×0.35 ] × M − P (clamped 0–100)
- R (Residency Score, 0–100): Same jurisdiction = 100 | Adequacy decision = 80 | SCCs/BCRs = 50 | No mechanism = 0
- T (Technical Controls, 0–100): (Encryption/3 × 50) + (Access Control/3 × 50)
- G (Governance, 0–100): (Audit Logs/3 × 40) + (DPA/2 × 35) + (Breach Plan/2 × 25)
- M (Strictness Multiplier): GDPR/HIPAA/LGPD = 1.0 | PDPA/CCPA = 0.85 | None = 0.60
- P (Risk Penalty, 0–30): min(DataClass × 0.5 × log₁₀(Records+1)/4 × min(ThirdParties/20, 1) × 30, 30)
Risk Levels: ≥80 = Compliant | 60–79 = Partially Compliant | 40–59 = At Risk | <40 = Non-Compliant
Assumptions & References
- Scoring weights (35/30/35) reflect that residency and governance are equally critical under GDPR Art. 44–49 and Art. 28–30, with technical controls as a supporting pillar.
- Residency scores align with GDPR Chapter V transfer mechanisms: adequacy decisions (Art. 45), SCCs (Art. 46(2)(c)), and BCRs (Art. 47).
- Technical controls scoring follows NIST SP 800-53 Rev. 5 (SC-8, SC-28, AC-2, AC-17) and ISO/IEC 27001:2022 Annex A controls.
- Governance scoring references GDPR Art. 28 (DPAs), Art. 33 (72-hour breach notification), and Art. 30 (Records of Processing Activities).
- Risk penalty uses logarithmic volume scaling to reflect diminishing marginal risk per additional record and linear sub-processor risk up to 20 processors.
- HIPAA Breach Notification Rule (45 CFR §164.400–414) requires notification within 60 days; GDPR within 72 hours to supervisory authority.
- CCPA (Cal. Civ. Code §1798.100) and PDPA (Thailand PDPA B.E. 2562) have less prescriptive residency requirements, hence lower strictness multiplier.
- This tool provides a directional compliance posture score and does not constitute legal advice. Engage a qualified DPO or legal counsel for formal compliance assessments.