The principle that data is subject to the laws and governance of the jurisdiction where it is collected or stored.