Glossary term
Data Sovereignty
Subject: Technology, Cyber and Data, Data Protection and Privacy
Data sovereignty is the principle that data is subject to the laws and courts of the country where it is stored or processed, so that country's authorities can control access to it.
Explanation
The idea is about legal control, not geography alone. If a company stores data in a foreign country, that country's law may allow its authorities to demand access, whatever the company's home rules say. Some countries also claim reach over data held abroad by their own firms, which creates conflict between legal systems. Sovereignty concerns lead governments to adopt localisation rules, favour domestic cloud providers or demand local control of encryption keys. Businesses respond by choosing hosting regions with care, using contract terms, and sometimes using sovereign cloud offerings run by local operators. It is wider than data localisation, which is only one tool for putting data under national law. Risk teams meet it in cloud migrations and cross-border projects. The hosting location decides whose law, and whose officials, can reach the data.
Example
A European public body plans to move citizen records to a global cloud provider. Its legal team notes that the provider is headquartered abroad and could be ordered by that country's courts to hand over data, even if servers are in Europe. The body chooses a locally operated provider with customer-held encryption keys.
Not to be confused with
- Data Localisation
- A specific rule requiring data to stay in-country. Sovereignty is the wider question of which state's law governs the data.