For many organizations, tracking where data is processed and stored can be a daunting task. Big data, the proliferation of connected devices and the growing number of employees who use their own devices for work make data mapping a potentially complex endeavor. Recent legislative and judicial developments are adding new wrinkles to the task. In the current landscape, it may no longer be enough to know where your data is; you also may need to know where it came from.

The Russian Parliament has passed a law that will require Internet companies that collect personal data from Russian citizens to store the data on Russian servers. Russia is not the only country to enact or contemplate data localization laws. When Greece implemented the EU’s Data Retention Directive (which the European Court of Justice recently struck down), the Greek law required companies to store data within Greek territory. British Columbia and Nova Scotia require public bodies to store personal information only in Canada. Taiwan’s Financial Supervisory Commission has called on foreign banks to process data in Taiwan. Australia requires that electronic health records not be stored overseas. And Brazil recently considered requiring ISPs to store information regarding Brazilian users only on local servers.

Organizations that are subject to data localization regimes would thus have strong reason to identify, or “tag,” personal data by information about its provenance. Such tags would serve to let systems and personnel know where the data came from, which would help ensure that the data is appropriately managed. If the data lacked a tag informing systems, users and administrators to “keep the data at home,” the data might end up stored in impermissible locations. This could cause organizations to face unwanted regulatory scrutiny. In Russia, for example, the data protection authority would be authorized to block the organization’s public Internet access for violating the localization requirement.

Data localization requirements are not the only reasons to tag data with its provenance.

• The European Court of Justice has ruled that European data protection laws extend to non-EU companies that have branches or subsidiaries in the EU and that collect personal data in the context of EU business activities. Non-EU organizations may therefore have to provide access, correction, deletion and blocking rights to EU citizens. Unless those organizations intend to provide EU-style rights to everyone, companies that operate under the jurisdiction of such European laws may have no option but to tag personal data as belonging to EU citizens so that they treat the data appropriately.

• Under the Australian Privacy Principles, which took effect in March of this year, individuals have certain rights regarding direct marketing communications. One of those rights is that if an organization uses or shares an individual’s personal data to conduct direct marketing on behalf of itself or others, the individual may request that the organization disclose the source of the personal data. The organization must comply with that request unless it is “impracticable or unreasonable to do so.”

• Brazil’s Marco Civil da Internet allows the Brazilian government to enforce the Brazilian Internet Law against any ISPs outside of Brazil that collect, store or process data collected from Brazilian users if the ISPs provide services to Brazilian users or maintain offices in Brazil. Organizations covered by this law will need to establish a mechanism by which they understand where they store Brazilian data in order to ensure that they comply with country-specific requirements.

National governments frequently promote data localization and long-arm jurisdiction provisions as measures that will protect their citizens’ privacy or security. The thought is that if data is stored locally or if laws reach beyond international borders, data can be protected from the prying eyes of foreign surveillance, and governments will be better able to prosecute those who violate privacy and data protection laws. Others might argue that data localization requirements, while seeming to be aimed at promoting privacy and security, are merely convenient ways to compel companies to invest in local IT infrastructure under the appealing to the virtues of privacy and security. Regardless of the motivation driving their enactment, however, it looks like data localization laws and long-arm jurisdiction are here to stay.

Organizations should therefore consider taking steps to identify the sources of the personal data that they collect and store. Another option for compliance is to adopt organization-wide information practices that reflect global data privacy standards, thus reducing the need for country-by-country customization. Regardless, by tagging data with its provenance, organizations can take steps to ensure that they treat and store the data appropriately in light of localization requirements. The technology market is attuned to the need to track the provenance of data, and we will likely see solutions emerge to make this task easier.

If personal data is not tagged for its provenance: organizations with EU operations may not store data in a manner that allows EU citizens to exercise their access rights; organizations marketing to Australians may face civil penalties for not complying with individuals’ requests regarding the source of their personal data; organizations providing services to Brazilians may find themselves struggling to comply with government access requests; and organizations may find themselves face to face with Russian regulators for storing personal data overseas.