Data Residency/Location

[RobertKeyser]

Fideslang should have a new classifier to represent where data is to be stored. This could capture places that data can or cannot be placed, e.g. US, EU, China, etc. Another point of location is whether data that's collected/processed/retained is done so locally on the client or on a server.

Both aspects of data location are often found in privacy policies, so including them in the Fides taxonomy would allow for a more comprehensive and declarative policy.

[NevilleS]

This does seem like a natural extension to the modelling problems that fideslang tackles right now. I'd likely want the ability to specify this on a System and then equally be able to include rules about processing in Policies... so it seems to fit into the same bag of features as data_use.

Unlike other metadata on System that is just a user-defined string (e.g. System.system_type), it might make sense to restrict this to a taxonomy of terms like global, us, eu, eu.germany, etc.

That said, it'd also be nice to avoid too much terminology sprawl, so finding ways to capture this as part of other declarations and not be wholly orthogonal would be nice, too.