For years the answer on where data sits has been fixed. It stays in country. It's written into policy, into tenders, and into the shape of nearly every architecture I've worked on here.
Then one of those places went down and did not come back. Not an outage. The buildings the data physically sat in stopped being available, permanently.
And I watched people who had spent years insisting the data could never leave the country start asking how quickly the data could leave the country. Not everyone. Enough that it stopped being an outlier.
Both things are true and they sit badly together. Residency is real, and the reasons behind it haven't gone anywhere. But a copy that only exists inside a boundary you can't reach isn't a recovery plan. It's a hope with a compliance tick next to it.
The uncomfortable part is what it says about how these things get designed. The standard answer is to spread the load across separate sites, on the reasoning that two will not fail at once. It is a good answer to the failures it was built for, which are the everyday ones. One site came back. Another didn't, and anything that lived only there is gone.
Resilience inside a boundary is still resilience inside that boundary. Worth knowing which failures your design actually covers, and saying so out loud before someone else finds out for you.