Where the bytes physically sit is residency. Whose courts can compel their disclosure is sovereignty. What you owe the people the data describes follows you regardless. Conflating the three is how a compliance claim outruns the infrastructure behind it.
Renting turns hardware into a monthly line item; colocating turns it back into an asset with jobs attached. The technical difference is small, the financial one decides everything. Build both sides over three years — and cost your own engineer's time honestly.
The failures in colocation are rarely technical: missing rails, a dual-PSU server on one feed, nobody with the IPMI password. Space, power, network, remote access and paperwork, in the order they cost you a day.