Data localization
A regulatory requirement, or a practical consequence of one, that certain categories of data remain physically stored or processed within a specific jurisdiction's borders, examined in Section 3K as the clearest evidence that the three paradigms are inherited governance architectures rather than purpose-built AI frameworks.
Defined in 2 GAGE programs, which carry 4 distinct definitions of it. The wording above is taught in Certified China AI Regulatory Professional (CCARP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The general regulatory practice, seen across several Chinese instruments, of requiring certain categories of data (particularly data connected to critical information infrastructure or collected within China) to be stored on servers located inside China unless a lawful cross-border transfer mechanism is used. (see Topic 5.4) covers this topic's full mechanics.
A requirement that certain personal data remain within a jurisdiction's borders. Where it applies, an AI feature that centralizes training data abroad cannot operate as built and must process locally or exclude the jurisdiction.
The requirement that certain categories of data, tied to critical information infrastructure operator status or important-data classification, be stored physically within China, with cross-border export permitted only as a narrow, security-assessed exception rather than a routine transfer choice.
A regulatory requirement, or a practical consequence of one, that certain categories of data remain physically stored or processed within a specific jurisdiction's borders, examined in Section 3K as the clearest evidence that the three paradigms are inherited governance architectures rather than purpose-built AI frameworks.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- The cross-border decision: where your organization may ship its AI feature, defended with citations · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- Why China's AI Rules Reach You · Onboarding: China Regulates AI First, Certified China AI Regulatory Professional (CCARP)
- Data Localization · Data Security for AI, Certified China AI Regulatory Professional (CCARP)
- Three Regulatory Paradigms · China, EU, US: The Comparative Playbook, Certified China AI Regulatory Professional (CCARP)
Where it shows up at work
A definition is where Data localization starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Compares the EU AI Act, NIST AI RMF, ISO/IEC 42001 and sector rules by intent and control objective, and says where they do not overlap.
One lesson on this page teach it as a primary outcome.
Applies IMDA's Model AI Governance Framework, AI Verify and the PDPA alongside Western frameworks for organizations operating across Asia.
One lesson on this page teach it as a primary outcome.
Applies GDPR, CCPA and sector rules to training data, inference, automated decisions, lawful basis, individual rights and cross-border transfer.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Compliance Managerneeds it at depth · 2 open postings this week
- Senior AI Compliance Analystneeds it at depth
- Security Compliance Managerneeds it at depth · 4 open postings this week
- AI Compliance Specialistneeds working knowledge · 1 open posting this week
- AI Controls Analystneeds working knowledge
- Compliance Analystneeds working knowledge · 2 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act; NIST AI RMF; ISO/IEC 42001; IMDA Model AI Governance Framework.
One interview question about it
Map one control to the EU AI Act, NIST AI RMF and ISO/IEC 42001 at once, and tell me where the mapping breaks.
Asked of candidates for framework crosswalking without false equivalence. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as work you can show: Privacy assessments and lawful-basis records are your work product.
- Legal and paralegal work carries it as a claim to back up: Privacy and consumer law are usually within reach.
- A law degree (JD, LLB or LLM), no AI work yet carries it as a claim to back up: Privacy and data protection law are usually a course, not yet a file.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.