Table of contents
What is data sovereignty?
Data sovereignty is the principle that data is subject to the laws of the jurisdiction that governs it, not only the place where it is stored. It concerns who can lawfully compel access, which depends on who operates the storage and who holds the keys.
Why storing data in-country does not settle it
A common assumption holds that data in a national data center is under national law alone. The reach of a law, though, can follow the company rather than the building. The US CLOUD Act of 2018, for example, allows US authorities to require US-based providers to produce data in their possession, custody or control, wherever it is stored. A provider headquartered under another legal system can therefore be asked for data that sits inside an organization's own borders. This is the gap between data residency, which is where data sits, and sovereignty, which is whose law applies.
The same logic works in reverse. Data held in the same country by an operator under local control, with keys the operator cannot reach, is a much narrower target for foreign requests.
Which four controls make sovereignty real?
| Control | What it decides | What fails without it |
|---|---|---|
| Operator and jurisdiction | Which legal system governs the company running the infrastructure | Foreign-law exposure through the provider, whatever the data center location |
| Key ownership | Who can decrypt the data | A provider that holds keys can be compelled to use them |
| Infrastructure control | Whether hardware and software run on systems the organization governs | Dependence on a third party for availability and access |
| Exit and portability | Whether data is stored in open formats and can move | Lock-in turns a legal change into a stranded dataset |
Key ownership carries the most weight. Customer-managed keys held outside the provider mean that a request to the provider returns only ciphertext. Exit matters because a change in law or contract is survivable only if data can be moved, which depends on open interfaces such as S3 rather than a proprietary format.
Which rules push organizations toward sovereignty?
In Europe the drivers are the GDPR rules on transfers of personal data outside the EU, the EU Data Act on switching providers and international access, DORA for financial entities and NIS2 for essential and important services. Sector rules in public administration, health and defense go further and sometimes require a national operator. Which rule applies to a given dataset is a legal question, and legal teams usually classify data before architecture is chosen.
What sovereignty means for backups and recovery
Backup copies are data too. A sovereign primary system with an offsite copy sent to a foreign-operated cloud leaves the most complete copy under foreign law. Backup targets, replicas and disaster recovery sites are therefore in scope, which is why sovereignty reviews tend to find the problem in secondary copies before the primary system. A self-operated object storage platform with owner-held keys keeps all copies under one set of rules.
Frequently asked questions
Is data sovereignty the same as data localization?
No. Localization is a legal requirement that data stay inside a country. Sovereignty is broader, covering who governs and can compel access, and a localization rule can be met while sovereignty is still weak.
Does a sovereign cloud solve the problem?
It depends on who operates it and under which law. A cloud region inside a country, operated by a foreign parent, narrows the problem only if contract and technical controls such as key custody stop the parent from reaching the data.
Can encryption alone provide sovereignty?
Only if the keys are out of the provider's reach. Encryption with provider-held keys leaves the provider able to decrypt on request.
Related terms
- Data residency: the physical location side of the question.
- Customer-managed keys: the key control that limits what a provider can hand over.
- Hardware security module: hardware protection for owner-held keys.
- Data breach: one legal consequence of losing control of data.
- Multi-region storage: where copies are placed across regions.
- Object storage: open S3 interfaces that keep data portable.