03 · What You Need to Know
Understanding AI Processing Locations and International Research Data Transfers
Why Does the Location of AI Processing Matter?
Research data may be subject to different legal, contractual, and institutional conditions depending on where and how they are processed.
For example, a Philippine university researcher may collect interviews locally but submit selected transcripts to an AI service that processes information through infrastructure in another country.
The processing arrangement may raise questions about international data transfers, applicable legal protections, provider access, and institutional authorization.
However, processing outside the researcher's country does not automatically mean that confidentiality has been breached or that the activity is prohibited.
The ethical and legal significance depends on the information involved, the organizations processing it, the safeguards in place, and the applicable framework.
Researchers should evaluate the actual data flow rather than treat geographic location alone as proof of either safety or risk.
Distinguish Data Storage, Data Processing, and Data Access
Researchers sometimes use the terms storage location and processing location interchangeably, although they may describe different arrangements.
Data storage location
The geographic or technical environment where information is retained.
Data processing location
The environment where information is handled, transformed, analyzed, or otherwise processed.
Data access adds another consideration: where authorized personnel or systems may access information, including possible access from outside the storage region.
For example, a provider may store information in a designated region while permitting certain operational processing or support access elsewhere under its applicable agreement.
These arrangements vary across services.
Researchers should therefore avoid assuming that a regional storage commitment necessarily establishes exclusive regional processing or access.
What Does Data Residency Mean?
Data residency generally refers to requirements or arrangements concerning the geographic location where information is stored or processed.
For example, an institution may require certain categories of research information to remain within a specified jurisdiction or approved cloud region.
However, data residency commitments differ across providers and products. Some may concern stored customer content, while others may address additional processing activities.
Researchers should examine the actual scope of the commitment rather than assume that the phrase "data residency" means all information and operational activity remain in one country.
Data residency should also be distinguished from data sovereignty, which concerns the relationship between information and the laws or governance authority applicable to it.
A particular storage region does not, by itself, resolve every question about applicable law or organizational access.
What AI-Related Locations Might Researchers Need to Examine?
Different parts of an AI service may involve different locations or organizations.
| Processing Element |
Possible Location Consideration |
Question for Researchers |
| Submitted research files |
Location where uploaded files are retained. |
Where may the service store the submitted material? |
| Model inference |
Infrastructure where prompts are processed and outputs generated. |
Where does the requested AI processing occur? |
| Operational logs |
Locations where relevant service records may be retained. |
Do logging arrangements involve additional regions? |
| Support access |
Jurisdictions from which authorized personnel may access information. |
What access arrangements apply? |
| Subprocessors |
Additional organizations and processing environments. |
Are other providers involved in handling the data? |
| Backups and recovery |
Locations covered by applicable backup arrangements. |
Are retained copies subject to different geographic conditions? |
Not every AI service uses all these arrangements, and not every component requires separate participant disclosure.
The table provides a framework for identifying relevant facts before determining what participants should be told.
Does International Processing Automatically Violate Research Ethics?
No. International processing may be permissible when it satisfies the applicable legal, contractual, and institutional requirements.
For example, a university may authorize an external AI provider under an agreement containing relevant data-protection and security safeguards.
However, authorization should be verified for the specific information and processing activity.
Researchers should not assume that every international transfer is prohibited, nor should they assume that using a reputable provider automatically makes every transfer acceptable.
The appropriate assessment concerns the actual processing arrangement, applicable transfer requirements, and risks to participants.
What Does the GDPR Require for International Transfers?
Under the European Union's General Data Protection Regulation, Chapter V establishes rules concerning transfers of personal data to third countries or international organizations.
Depending on the circumstances, relevant transfer mechanisms may include adequacy decisions, appropriate safeguards such as standard contractual clauses, or specific derogations where their conditions are satisfied.
Articles 13 and 14 also establish transparency requirements concerning intended international transfers and relevant safeguards, where applicable.
However, the GDPR does not govern every research dataset worldwide simply because an AI provider operates internationally.
Researchers should first determine whether the GDPR applies to the particular processing arrangement and then identify the relevant obligations.
Where it applies, a general statement that data will be processed "in the cloud" may not satisfy the required transfer information.
What Does the Philippine Data Privacy Act Require?
In the Philippines, Republic Act No. 10173 establishes principles of transparency, legitimate purpose, and proportionality in the processing of personal information.
The Act and its implementing rules also establish obligations concerning accountability and appropriate safeguards.
Cross-border processing is not categorically prohibited under the Data Privacy Act. However, the responsible personal information controller remains subject to applicable obligations concerning lawful processing and protection of personal information.
For example, a Philippine university considering an external AI provider should assess the contractual arrangement, relevant data recipients, processing purposes, and applicable security requirements.
The specific disclosure and transfer obligations depend on the processing circumstances and relevant National Privacy Commission guidance.
Researchers should consult institutional data protection personnel rather than assume that all international AI processing follows the same legal rules.
Should Participants Be Told the Exact Country?
The answer depends on the applicable requirements and the information material to participation.
For example, a provider may contractually commit to processing specified information within a particular region. Where that location is relevant or required, it may be appropriate to identify the region or country.
However, some services use multiple processing locations or arrangements that may change according to configuration.
Researchers should not invent a precise country when the provider documentation does not establish one.
Nor should they assume that identifying the provider's headquarters accurately describes where research data will be processed.
When exact locations cannot be established, the researcher should determine whether the available arrangement satisfies institutional requirements before proceeding.
Why Naming the Provider Is Not the Same as Disclosing Location
A provider's name does not necessarily identify the geographic location of its processing infrastructure.
For example, a technology company headquartered in one country may operate services through infrastructure located in several jurisdictions.
Likewise, an institution may access a service through a regional cloud arrangement that differs from the provider's general consumer offering.
Researchers should therefore distinguish identifying the AI provider from explaining the relevant geographic processing conditions.
Both may matter, but they answer different questions.
Can Data Be Processed Abroad Without Being Publicly Disclosed?
Yes. International processing and public disclosure are different concepts.
A provider may process information abroad under contractual confidentiality restrictions and technical safeguards.
However, those safeguards do not eliminate the need to assess whether the processing is authorized and consistent with participant information.
Researchers should avoid suggesting that international processing necessarily means public access.
They should also avoid assuring participants that information remains exclusively within the research institution when it is actually transferred to an external service.
How Should Researchers Explain International Processing to Participants?
The explanation should reflect verified processing conditions and the information required by the applicable framework.
Illustrative Participant Information
Explaining External AI Processing Locations
"Selected portions of your interview transcript may be processed using an external generative AI service authorized for this study. Depending on the verified service arrangement, processing may involve infrastructure outside the Philippines. The research team will use the service only under the data-protection and confidentiality conditions approved by the university. Information about the applicable processing locations and safeguards will be provided in the study's data privacy notice."
This wording is illustrative and should not be used to substitute for required country-specific information or verified transfer details.
If the institution or applicable law requires particular locations or safeguards to be identified, the researcher should provide those details accurately.
The final statement should reflect the actual provider arrangement rather than an assumed international processing model.
Can Researchers Use AI to Identify Possible Location Disclosure Issues?
Generative AI can help organize questions about processing locations, but it should not be treated as an authoritative source for a provider's current infrastructure or contractual commitments.
Illustrative AI Prompt
Reviewing AI Processing Location Disclosure
"I am preparing participant information for a research study involving an external generative AI service. I will provide the verified provider agreement, data categories, processing locations, access arrangements, and applicable institutional requirements. Identify what information about international processing may be material or legally required for participant disclosure. Distinguish data storage, model processing, support access, and subprocessors. Suggest clear wording without inventing countries, data residency guarantees, or transfer safeguards. Identify unresolved matters requiring confirmation from the provider or institutional data protection officer."
The researcher should verify the resulting suggestions against authoritative provider documentation and institutional requirements.
What If the Provider Changes Its Processing Locations?
AI providers may modify infrastructure, subprocessors, or service configurations over time.
For example, a service initially authorized for processing within a specified region may later introduce a different arrangement.
Whether the change requires institutional notification, revised participant information, or additional authorization depends on its significance and the applicable requirements.
Researchers should examine contractual change-notification provisions and institutional procedures for consequential modifications.
They should not assume that an earlier processing-location assessment remains valid indefinitely.
What If the Provider Cannot Confirm the Processing Location?
Sometimes the provider's public documentation may not establish every location involved in processing.
Researchers should distinguish information that is genuinely unavailable from information that can be obtained through institutional agreements or provider documentation.
If the processing location is necessary for determining legal compliance or institutional authorization, unresolved uncertainty may prevent the proposed service from being used with protected research data.
The researcher should seek clarification from the appropriate institutional or provider representatives.
Where adequate information or safeguards cannot be established, an authorized alternative may be preferable.
Researchers should not ask participants to accept a processing arrangement whose essential conditions remain unknown to the research team.
Does Location Disclosure Alone Make the Transfer Acceptable?
No. Informing participants that data may be processed abroad does not independently establish that the transfer is lawful, secure, or ethically justified.
For example, a researcher cannot make an otherwise unauthorized transfer acceptable merely by identifying the destination country in the consent form.
The processing must still satisfy applicable authorization, data-protection, confidentiality, and research ethics requirements.
Disclosure supports transparency, but it does not replace the substantive evaluation of the transfer.
