01 · The Question
Does It Matter Where an AI Service Sends or Processes Participant Data?
You conduct research in one country, your university is located there, and participants were recruited there. Then you upload their data to an AI service. Where does the information actually go?
Cloud services can make geography almost invisible to the user. The website opens in your browser regardless of whether the underlying data are stored, processed, backed up, routed, or accessed in your country or somewhere else.
Legally and institutionally, however, location can matter. Some data-protection frameworks regulate international transfers, institutions may restrict where sensitive research data can be processed, contracts may specify permitted regions, and participant-facing materials may make commitments about where information will be held.
The difficulty is that “Where is my data?” does not always have one answer.
03 · What You Need to Know
“Where the Data Are” Can Mean Several Different Things
Company Headquarters Are Not the Same as Data Location
A provider incorporated in one country may operate infrastructure in many others. It may contract through a regional legal entity, use global cloud infrastructure, rely on subprocessors, and offer customers a choice of storage regions.
Conversely, a server physically located in your country does not necessarily mean that every legal issue associated with international processing disappears.
The first mistake to avoid is therefore answering “Where is the data processed?” by looking only at the company's mailing address.
Storage Location and Processing Location Are Different
Modern AI services make this distinction particularly important.
Data residency or storage location
The region where covered customer content is stored at rest, subject to the provider's applicable terms and exceptions.
Processing or inference location
The location where computation is performed on the data, such as running model inference to generate an AI response.
A service can store customer content in one region while performing some processing elsewhere. Researchers should therefore avoid treating “EU data residency,” “Singapore storage,” or another residency label as proof that every operation involving the data remains within that region.
Current AI Services Illustrate Why the Distinction Matters
OpenAI's current documentation, for example, distinguishes data residency from inference residency for eligible ChatGPT Enterprise and Edu customers. Data residency controls where specified customer content is stored at rest, while inference residency can additionally constrain GPU model inference to supported regions. OpenAI also states that some non-GPU processing, external integrations, and system-related processing may still occur outside the selected inference region.
The point is not that researchers should select one particular provider. It is that modern AI systems can have several processing layers, each with different geographical characteristics.
Provider capabilities and supported regions can change. Researchers should verify current documentation and institutional contracts at the time of the study rather than relying on an old description of where a service operated.
Subprocessors Can Add More Locations
An AI provider may rely on cloud infrastructure companies, content-delivery networks, security services, and other subprocessors. Those organizations can operate in multiple countries.
For example, current OpenAI documentation publishes a subprocessor list that identifies processing locations for relevant business services. The listed infrastructure providers operate across numerous countries. This illustrates why the location question should extend beyond the company whose name appears on the AI interface.
Researchers should identify which subprocessors apply to the particular service and contractual arrangement rather than assuming that every organization on a provider's general list necessarily receives their specific research data.
International Transfer Rules Can Apply to Cloud Processing
Some privacy frameworks impose specific conditions when personal information is transferred to another country or made accessible to an organization abroad.
Under UK data-protection guidance, for example, a restricted international transfer can occur when personal information subject to the UK GDPR is sent or made accessible to a separate organization located outside the UK. The ICO specifically notes that cloud-service arrangements can involve restricted transfers and advises organizations to examine the legal entities and transfer relationships involved.
That means location analysis is not merely about where bits happen to sit on a hard drive. The legal entities involved, contractual relationships, and accessibility of the information can also matter.
Server Geography Alone May Not Determine Whether a Legal Transfer Occurs
This point is easy to miss.
The ICO explains, for example, that under the UK GDPR, storing information on servers outside the UK does not by itself determine whether a restricted transfer occurs. If the same UK legal entity owns and operates servers abroad, moving information internally between those servers is not necessarily a restricted transfer under that framework. Conversely, contracting with a separate organization located outside the UK may constitute a restricted transfer even if that organization's servers are physically located in the UK.
This is a jurisdiction-specific example, but it demonstrates why researchers should not reduce international-transfer analysis to a map of data centers.
The Philippines Requires Accountability for Domestic and International Processing
The Philippine Data Privacy Act states that a personal information controller remains responsible for personal information under its control or custody, including information transferred to a third party for processing domestically or internationally.
Its Implementing Rules and Regulations similarly require controllers to use contractual or other reasonable means to provide a comparable level of protection while personal data are processed by a personal information processor or third party.
For outsourcing arrangements, the Rules require the governing contract or legal act to specify, among other things, the geographic location of processing. They also require processors to follow documented instructions concerning transfers to another country or international organization unless otherwise authorized by law.
For researchers in Philippine institutions, the location of outsourced AI processing is therefore not merely an interesting technical detail. It can be part of the required governance of the processing arrangement.
Cross-Border Processing Is Not Automatically Prohibited
The fact that participant information crosses a national border does not necessarily make the processing unlawful or unethical.
Different legal systems provide mechanisms under which international transfers may occur, subject to applicable conditions and safeguards. Institutions may also authorize particular cloud environments or contractual arrangements for international processing.
The correct response is therefore not “participant data must never leave the country.” Such a statement would be too broad.
The appropriate question is whether the proposed transfer or processing arrangement satisfies the requirements that govern the specific data, institution, study, and jurisdictions involved.
Data Residency Does Not Automatically Make an AI Service Research-Approved
Suppose a provider offers storage in your preferred country. That solves one part of the problem.
It does not establish that:
- the service is approved by your institution;
- the data are not used for unauthorized purposes;
- all processing occurs in that country;
- no subprocessors operate elsewhere;
- the service satisfies the required security classification;
- the study's consent permits the processing; or
- the ethics protocol authorizes the external provider.
Residency is therefore a control, not a universal compliance certificate.
Data Location Can Matter Even When the Provider Does Not Train on Your Data
A provider may promise not to use customer content for model training while still storing or processing that content in another jurisdiction. These are different dimensions of data governance.
Training addresses what the provider may use information for. Residency addresses where certain information is stored. Inference residency addresses where specified model computation occurs. Retention addresses how long information persists. Access controls address who can reach it.
A favorable answer to one question should not be used as the answer to all the others.
Remote Access Can Matter Too
International data movement does not always involve copying a file onto a foreign server. In some frameworks, making personal information accessible to an organization abroad can itself constitute a transfer.
The ICO, for example, explicitly includes making information accessible to a separate organization outside the UK within its international-transfer analysis.
Researchers should therefore consider remote support, administrative access, subprocessors, and other access pathways where relevant rather than focusing solely on primary storage.
Participant Consent and Ethics Materials May Contain Location Commitments
Even where privacy law permits international processing, the research team may have made a narrower commitment.
A consent form might say that data will remain on university servers. An approved protocol may specify an institutional research drive. A data-management plan might restrict storage to a particular country. A sponsor agreement may require a specified hosting region.
If the new AI workflow conflicts with those arrangements, the fact that an international transfer could theoretically be lawful does not resolve the research-governance problem.
For studies where AI was introduced later, researchers should determine whether existing participant consent covers the unanticipated AI processing.
Sensitive Data Can Make Location More Consequential
The consequences of international processing may be greater when the information involves health, genetics, biometrics, vulnerable populations, politically sensitive research, confidential interviews, or other high-risk material.
Institutional security classifications may restrict where such information can be processed even when less sensitive research data may use ordinary cloud services.
This is why the broad question of whether participant data can be uploaded to an AI tool should be answered before selecting a convenient overseas service.
Watch Out
Do not ask only, “Where is the server?” For cloud AI, you may also need to know which legal entity receives the data, where content is stored at rest, where model inference and other processing occur, whether remote access occurs elsewhere, and which subprocessors are involved. Those answers may not point to the same country.
