What Is Data Sovereignty?

Data sovereignty is the principle that data is subject to the laws of the country or jurisdiction that governs it. In practice it means understanding — and being able to control — which government could compel access to your data, which courts could rule on it, and which regulator holds you accountable for it.

The distinction that matters most is this: sovereignty is a question of legal jurisdiction, not merely of geography. Storing data in a data centre inside your own country does not by itself put that data beyond the reach of a foreign government, because the jurisdiction that counts is often the one governing the operator of the service rather than the soil the servers sit on. Requirements vary considerably by sector and country, so what follows is orientation rather than legal advice.

Data sovereignty vs. data residency vs. data localization

These three terms are used interchangeably in vendor marketing, but they describe different things — and conflating them is the most common way organizations end up with a false sense of security.

• Data residency is where data physically sits. It is a technical and contractual choice: you select a region, and your provider stores your data there.
• Data localization is a legal requirement that certain data must remain within a country's borders. It is imposed by regulation, not chosen.
• Data sovereignty is whose law applies and who can ultimately compel access. It depends on the jurisdiction of the operator and the entities holding the keys, as much as on location.

Residency is therefore a component of sovereignty, not a substitute for it. You can satisfy a residency commitment and a localization law in full and still lack sovereignty, if the company operating the storage is answerable to a foreign court.

Why data location alone does not deliver sovereignty

The clearest illustration is the US CLOUD Act. It allows US authorities to compel a provider subject to US jurisdiction to produce data in its possession or control — regardless of which country that data is stored in. A European subsidiary operating a European data centre does not necessarily escape that reach if its parent company is US-based.

This creates a genuine bind for the provider rather than a simple choice. Complying with a CLOUD Act demand may put it in breach of EU law; refusing may expose it to consequences under US law. The organization whose data it is inherits the consequences of that conflict without controlling its resolution.

Two things change the picture materially. The first is who operates the service: infrastructure you run yourself, or that is operated by an entity subject only to your own jurisdiction, removes the foreign-compulsion pathway. The second is who holds the encryption keys: if the operator cannot decrypt your data, a compelled disclosure produces ciphertext rather than readable information.

The regulations that drive data sovereignty

Sovereignty moved from a policy discussion to a procurement requirement through a series of concrete legal developments.

GDPR and the transfer question. The GDPR restricts transfers of personal data outside the EU unless equivalent protection is assured. In 2020 the Court of Justice of the EU invalidated the EU–US Privacy Shield in the ruling widely known as Schrems II, on the grounds that US surveillance law did not provide that equivalence. Its replacement, the EU–US Data Privacy Framework, was adopted in 2023 and was upheld by the EU General Court in September 2025; an appeal to the Court of Justice remains pending as of mid-2026. Transatlantic transfer remains legally workable but not settled, which is why many organizations have chosen to reduce their exposure to it structurally.

The EU Data Act. Applicable since 12 September 2025, it gives customers of cloud and data-processing services statutory rights to switch providers and to receive technical cooperation in porting their data, and it addresses unlawful third-country government access to non-personal data. Switching charges are prohibited outright from 12 January 2027. The practical effect is to make provider lock-in a compliance concern, not just a commercial one.

Sector-specific regimes. Financial services face DORA, critical infrastructure faces NIS2, healthcare data in the US falls under HIPAA, and public-sector bodies in many countries operate under national cloud policies that specify permitted jurisdictions.

How organizations achieve data sovereignty

Sovereignty is an architectural outcome rather than a certificate, and it is usually assembled from four controls.

• Choose the jurisdiction of the operator, not just the region. Ask which legal entity controls the infrastructure and which courts it answers to. This is the question that residency commitments do not answer.
• Hold your own encryption keys. Encryption at rest only contributes to sovereignty if the keys sit outside the storage platform, under your control, in a key management system you operate. Otherwise the operator can produce plaintext.
• Keep the data on infrastructure you control. Self-hosted or on-premises storage in your own facility removes third-party compulsion from the equation entirely, which is why regulated and public-sector organizations continue to choose it for their most sensitive data.
• Secure a real exit. Sovereignty you cannot leave with is fragile. Verify that data can be exported in an open, usable format, and that portability is contractual rather than aspirational.

These controls compose with — rather than replace — data-protection measures such as S3 Object Lock and WORM retention, which govern whether data can be altered rather than who may see it.

Data sovereignty and ARTESCA

Scality ARTESCA is software you deploy on your own standard servers, in your own data centre and your own jurisdiction. There is no third-party operator holding your data and no foreign parent company that could be compelled to produce it, because the entity in control of the infrastructure is you.

Data at rest is encrypted with AES-256, and keys are managed through an external KMIP-compatible key management server rather than being stored on the storage system itself. That separation is what makes the encryption meaningful for sovereignty: the platform holds ciphertext, and you hold the means to read it.

Because ARTESCA presents a standard S3-compatible interface, applications and backup software written for public-cloud object storage run against it unchanged. Organizations can move sensitive workloads out of a foreign-operated cloud without rewriting them — and pair that with immutability through S3 Object Lock, so the same data is both sovereign and protected against ransomware.

Data sovereignty FAQs

Is data sovereignty the same as data residency?

No. Residency describes where data is physically stored; sovereignty describes which laws govern it and who can compel access to it. You can meet a residency requirement in full and still not have sovereignty if the operator of the service is subject to a foreign jurisdiction.

Does storing data in the EU protect it from US government access?

Not on its own. Under the US CLOUD Act, a provider subject to US jurisdiction can be compelled to produce data it controls wherever that data is stored. Reducing that exposure depends on the jurisdiction of the operator and on who holds the encryption keys.

Does encryption solve data sovereignty?

Only when you control the keys. If the storage provider can decrypt your data, it can be compelled to hand over readable data. If keys are held in a key management system you operate, a compelled disclosure yields ciphertext.

What is a sovereign cloud?

A deployment designed so that the infrastructure, its operator, and its support staff all fall within a single chosen jurisdiction, with no dependency on foreign providers. Self-hosted infrastructure achieves the same outcome directly.

Which regulations drive data sovereignty requirements?

Most commonly the GDPR and its restrictions on international transfers, the EU Data Act's switching and access provisions, and sector regimes such as DORA for financial services, NIS2 for critical infrastructure, and HIPAA for US healthcare data.