The Residency Question: Mapping Where UK Scanned Records Actually Live in 2026

A document capture project rarely produces a single data set. It produces scanned images, OCR text, extracted index fields, workflow metadata, user activity logs, audit trails and backups. Each of those may be stored, processed, replicated or supported from a different location. When a UK organisation asks whether a capture system is 'cloud' or 'on-premise', it is therefore asking a useful but incomplete question. The more important question is where each category of data actually lives, who can access it, how long it is kept, and what evidence the vendor can provide.

Why paper capture raises a residency question

Paper records often contain personal data, financial information, employment details or commercially sensitive material. Once captured, that information may move through several systems: scanning software, OCR engines, validation queues, document management platforms, email notifications and backup services. UK GDPR and the Data Protection Act 2018 do not ban international transfers, but they require lawful grounds, appropriate safeguards and transparency. The ICO expects organisations to understand their data flows, including transfers to subprocessors and support providers.

A captured document can also be more revealing than the paper original. OCR may extract names, account numbers and addresses into searchable text. Workflow logs may show who reviewed a document and when. Backup copies may persist after the live record has been deleted. A residency checklist therefore needs to cover the whole capture chain, not only the primary storage bucket.

Three architectures, three trade-offs

Local capture

In a local architecture, scanning hardware, capture software and storage sit on the organisation's own infrastructure. This can suit records with high sensitivity or strict internal governance, and it keeps day-to-day data within the organisation's environment. The trade-off is operational: the organisation must manage patching, backup, disaster recovery, storage growth and secure remote access. Local does not automatically mean compliant or resilient; it means the responsibility sits closer to home.

Hybrid capture

A hybrid model typically scans and indexes locally, then sends approved records or metadata to a cloud repository or workflow platform. This can be a pragmatic compromise for UK SMEs that want local control over intake but need cloud collaboration or scalable storage. The residency question becomes more complex because data crosses a boundary. The organisation should know which fields are transferred, whether images or only metadata move, and whether any cloud processing — OCR, classification or validation — occurs outside the UK.

Cloud capture

In a cloud architecture, scanning devices may be local, but capture processing, storage, workflow and backups are provided as a service. This can offer resilience and remote access, but it requires careful vendor assessment. The relevant details include the location of primary data centres, replication regions, support access, subprocessor locations and the transfer mechanism used for any data leaving the UK. A vendor's head office being in the UK does not mean its processing is UK-based.

A vendor checklist for UK buyers

Ask for written answers, not verbal assurances. A useful checklist includes:

• Where is the primary storage for scanned images, OCR text, metadata and audit logs?
• Which subprocessors are involved, and where are they located?
• Is any data processed outside the UK, including support, monitoring or disaster recovery?
• What transfer mechanism applies to restricted transfers, such as the IDTA or the UK Addendum?
• How is data encrypted in transit and at rest, and who manages the keys?
• What retention periods apply to live records, logs and backups?
• How are deletion requests handled, and how quickly are backups purged?
• Can the organisation export its records and metadata on exit?
• What audit trail is available, and how long is it retained?
• Which personnel can access the data, and under what controls?

The answers should be consistent across the contract, the data processing agreement, the subprocessor list and the technical documentation. Inconsistency is itself a warning sign.

Matching architecture to record sensitivity

Not every document needs the same residency model. A low-risk archive of published brochures may be suitable for a standard cloud capture service. HR files, customer identity documents or case notes warrant a more detailed assessment. A practical approach is to classify records by sensitivity before choosing the architecture. High-sensitivity records may justify local storage or a UK-only hosted model with restricted support access. Medium-sensitivity records may be acceptable in a hybrid model with clear transfer safeguards. Low-sensitivity records can often use standard cloud services with routine controls.

This classification should be documented. It helps the organisation explain why one department uses a local workflow and another uses a cloud platform, rather than treating inconsistency as an accident.

Retention controls and the backup problem

Retention is where residency and deletion meet. A vendor may delete a record from the live system promptly while retaining it in backups for months. That is not necessarily wrong, but it must be disclosed and covered by policy. Ask how retention rules are applied, whether they can be set by record type, and how legal holds are managed. For UK organisations subject to sector rules or internal records policies, the capture system should support defensible disposal rather than relying on manual clean-up.

Contract points and evidence

The contract should name the processing locations, require notification of material changes, and give the organisation a route to object to new subprocessors. It should also set out breach notification, assistance with data subject requests and exit provisions. A data protection impact assessment may be appropriate for high-risk capture workflows. The point is not to turn every scanning project into a legal exercise. It is to ensure that the organisation can answer a simple question with evidence: when a document is scanned, where does it go, and who can see it?

In 2026, UK buyers have more capture options than ever. The sensible approach is to match the architecture to the record, not to the sales brochure. Residency is a design decision, and it should be made before the first page is scanned.