What Is Data Sovereignty?

Data sovereignty refers to the application of laws to a user’s data—specifically, which jurisdiction’s laws apply to that data and what rights are protected for each individual user regarding privacy, usage by an organization, and consent. The most well-known example including data sovereignty principles is the General Data Protection Order (GDPR) from the European Union (EU), which defines how the data of EU citizens is protected in terms of collection and use.

What Is Data Sovereignty?

Data sovereignty refers to the concept that data is subject to the laws and regulations of the geography in which its owners are located. In general, data sovereignty rules put the responsibility of managing and protecting user data on the organization collecting and processing it. User privacy and security issues must be addressed by the organization, and it must comply with the regulations of the user's country or state of residency. This means that multiple layers of compliance are required for organizations with multinational user bases. For example, an organization with users in the EU and the United States may be required to comply with the EU's GDPR as well as the data sovereignty laws of individual states.

In general, data sovereignty laws around the world have significant overlap, with some being more restrictive than others.

Key Takeaways

• Data sovereignty is the concept that legal data issues, regulations, and restrictions fall under the jurisdiction of the nation, state, or region from which the data is generated.
• Determining data sovereignty may often involve related issues such as data localization, data residency, and data privacy.
• Some of the most well-known examples of data sovereignty include the EU’s GDPR, California’s CCPA, and the concept of indigenous data sovereignty.
• Organizations must continuously evaluate regional laws, their own cloud computing specifics, and their own state of security and hardware.

Data Sovereignty Explained

Data sovereignty is a weighty concept with many distinct aspects, though the basics can be drilled down into the following points:

• Who’s involved. Data sovereignty may involve several parties, though the responsibility may ultimately come down to the organization collecting or selling the data. Parties may include these organizations, the individuals whose data is being collected, the cloud providers storing the data, and the countries/regions/states dictating the guiding laws that oversee the data. Within an organization, data sovereignty oversight may include IT departments and legal teams.

• What’s at stake. For organizations that fail to meet regulatory guidelines, the result can be a complex, and possibly international, web of legal issues and fines. Legal consequences can spiral into further problems for an organization, either cutting off regions of customers or stalling business operations.

  Investing in compliance may enable organizations to meet regulatory requirements.

• Who benefits. While individual data owners may inherently benefit from data sovereignty due to its focus on protection and oversight, businesses may see advantages as well. On one level, a business may benefit simply by keeping operations going and establishing a sturdy foundation for future compliance. In addition, consistent compliance may help build public trust, which can serve as part of public relations or marketing messaging to draw in further business.

Why Is Data Sovereignty Important?

Data sovereignty is important because it may ensure that laws and regulations applicable to data are observed. That’s often easier said than done now, because over the past 20 years, the way data is used within organizations has completely changed. When data became dynamic and mobile, it also faced greater risk—files no longer stayed within the confines of local drives and devices, and databases began storing records far beyond a few specific applications. This expanded reach of data spawned many different types of risk. Guarding against those hazards became a matter of increasing importance, particularly as cyberattacks grew in sophistication and data transmissions began to cross international borders.

Today, some of the most important areas of data sovereignty include the following:

• Legal. In recent years, various countries and regions have established data protection regulations addressing privacy, security, and storage concerns regarding the location of physical data storage. A prime example of this is the EU's GDPR law. These types of regulations cover areas such as website visitor data and product usage data. Failure to comply may lead to complex legal issues, which can then lead to both operational and financial complications.

• Security. Who has access to sensitive data? Be it financial, personal, or organizational intellectual property, controlling access to sensitive data is a crucial element of data sovereignty. In some cases, regional laws also address the privacy aspect of data collection. All of this may point to the need to maintain control over security, access, and storage.

• Continuity. In a world of globally distributed data, public cloud providers could theoretically store backups at data centers located in other countries. This creates an issue if severe outages or natural disasters disrupt access and connectivity. It also raises the question of jurisdiction—if someone hacks a cloud provider’s data center, which laws would apply to protect violated users residing all over the world? Data sovereignty strategies may help ensure that storage is kept within specific regions. In terms of access during extreme circumstances, that locality enables quick backup connectivity without latency issues due to geographical distance or legal access issues due to regional laws.

How Does Data Sovereignty Work?

Companies that collect and store data must address the data sovereignty laws of the countries in which they operate, and that work can involve storing data in specific locations, implementing security measures, and seeing that data is handled in compliance with local regulations. This can be a complex and challenging process, especially for multinational companies that operate in multiple jurisdictions.

A basic workflow for data sovereignty compliance may go as follows:

1. An organization assesses the current state of its data, including its internal security protocols and physical locations of data centers.
2. The locations of customers and users then create a basis for identifying relevant data sovereignty laws.
3. The organization’s IT and legal teams evaluate whether they comply with the laws of different regions—and, if not, they must determine the necessary steps to achieve compliance.
4. The organization conducts an ongoing survey of its customers and laws to help ensure that no updates are missed.

Data Sovereignty vs. Data Localization vs. Data Residency vs. Data Privacy

Data sovereignty is a complex concept that contains several different interconnected elements. Jurisdictions, laws, and locations of hardware all factor into the dynamic formula of data sovereignty. The most important elements of this concept are as follows:

Data Sovereignty

At its core, data sovereignty refers to the legal oversight of data based on the regulations of the country where it was generated. Variables such as a global user bases, remote workers, and cloud storage data centers make this initial concept much more complex. Because of this, factors such as where data resides, where it’s collected, and how it’s collected are essential to understanding the issues at stake.

Data Localization

Data localization exists somewhere between data residency and data sovereignty. It refers to the idea that data generated by a region's citizens should reside within that region before it’s used externally. Data localization restrictions stem from privacy and security concerns, particularly when organizations handle sensitive, personal, or financial data.

Data Residency

Data residency is the term given to the physical location of an organization’s data. If data is stored in a different country or region from where it’s generated, data residency laws from that particular region then apply, adding further layers of compliance complexity.

Data Privacy

Data privacy refers to the protection of users’ personal data. Websites and applications can collect this data in several ways, including forms, user-provided information, and website cookies. Issues such as consent and the legality of collection are at the forefront of data privacy concerns, and regions have started to institute their own data privacy laws to protect citizens from scams and abuses.

Key Differences

The main differences between data sovereignty, data localization, data residency, and data privacy stem from how they relate to one another. Data sovereignty refers to the overall umbrella including jurisdictions, citizens, organizations, and laws. Data localization dictates how user data should be treated, while data residency and data privacy refer to the definitions used when examining the broader concepts. The following illustration provides a visual flow of how these concepts work together.

History of Data Sovereignty

As computers evolved from room-size behemoths to desktop machines, data access evolved as well. Security became the realm of physical storage media, local area networks, and data centers. As data became more portable and dynamically transmittable, the first notions of data sovereignty appeared. In the EU, the Data Protection Directive of 1995 restricted the processing and storage of EU citizens’ data to those borders. Across the Atlantic, the United States also considered data sovereignty from different angles, including the 2001 PATRIOT Act, which fundamentally changed what citizen data the US government legally could access. The law granted the federal government access to data stored within American jurisdictions as well as data managed by companies operating within US borders.

That era dealt with physical media, dial-up modems, and the internet as a niche service. But in the ensuing years, digital transformation has been widespread across industries and communities, spanning home internet access, online financial transactions, personal data via social media, all the way to everyday cloud storage, digital currency, and Internet of Things (IoT) devices. Suddenly, the importance of data sovereignty grew exponentially. Corporations started sharing data across international borders, cybercrime became an everyday risk, citizens made online purchases from distant locales, and governments were caught illegally monitoring personal data. All these shifts created the need to establish some order in the chaos, particularly with different jurisdictions involved.

Today, the notion of data sovereignty encompasses a wide range of topics, including local legalities, privacy concerns, the physical location of cloud storage servers, and more. As devices integrate further into every aspect of our daily lives and businesses push the bounds of remote work, data sovereignty will only get more complicated—and more essential—with every passing year.

Data Sovereignty & GDPR

In 1995, the EU's Data Protection Directive (DPD) came into effect at the dawn of the internet age. Officially known as Directive 95/46/EC, the DPD was foundational to the way the world looks at data privacy in terms of fundamental rights and freedoms. Key topics within the DPD included the following:

• Transparency when processing an EU citizen’s data
• Defining intent and purpose of storage and processing
• Laws applying to transferring data outside of the EU
• Limitations of how and why personal data could be processed to ensure privacy

In the 20 years since then, the use of data has exploded worldwide, first via home broadband access to the internet, then the emergence of social media, and then the use of Internet of Things (IoT) devices such as smartphones—which all constantly collect large amounts of personal data. This evolution revealed the gaps in the DPD’s protections, as data began to flow in ways that were previously unimaginable.

Adopted in 2016 and active since 2018, the General Data Protection Regulation (GDPR) superseded the DPD and built upon all of its key tenets, including basic data rights, regulations for supervisory authorities, and limitations on transferring personal data to third countries. Significantly, the GDPR established that organizations must only collect and handle personal data in legally authorized ways, including subject consent, contractual obligation, or public interest in official authority. Concerns about consent and government authority arose in the decade before the GDPR took effect, as revelations emerged regarding American data usage under the PATRIOT Act. The GDPR clarified and simplified personal data access, ownership, consent, complaints, and restrictions for stronger legal boundaries and greater individual ownership while shifting liabilities and responsibilities to organizations and data controllers.

Widely recognized as the most influential data protection law in history, the GDPR helped spur action on data protection around the world. In the United States, several states passed their own laws regarding data generated by residents, including the California Consumer Privacy Act and the Colorado Privacy Act. South Africa, Thailand, Singapore, and other countries have also followed suit.

5 Key Data Sovereignty Challenges

Data sovereignty can be a unique and often challenging journey—once an organization hits its goals, the process continues due to evolving regulations and new guidelines from emerging territories. Organizations must stay on top of all these variables as they make crucial IT choices and assess ramifications. The following list represents the most common challenges of data sovereignty:

• Operating in multiple countries. If your organization operates in multiple countries, data sovereignty may instantly become more complex. Data collection regulations depend upon the jurisdiction in which processes occur. A multinational corporation may have to navigate the regional variations and nuances of data laws across the areas where they operate.

• Continuously changing laws. Existing laws such as the EU GDPR and the CCPA in the United States may continue to see updates, even as other jurisdictions introduce their own versions of data protection. Each organization is responsible for keeping track of these changes to maintain compliance, since legal liabilities for data privacy and protection may fall upon entities rather than individuals. For example, the UK still maintained the standard of the GDPR after its 2020 exit from the EU, but it can dictate how the law evolves for UK residents independently.

• Vendor storage locations. If your organization uses a public cloud for its data needs, the public cloud’s physical storage and processing locations may become a factor. If data privacy laws require that data resides within a user’s jurisdiction, organizations may address whether to communicate with vendors about any specific legal requirements regarding geographical location.

• Initial investments. Data sovereignty requires a financial commitment. If you’re running a local data center, that could mean migrating to the cloud. If you’re collecting sensitive data such as financial information, you may need to implement new layers of security. The specific steps required to achieve sound data sovereignty are unique for each organization. They may also call for considerable time and effort spent on retraining employees on those specifics. Whatever your data sovereignty journey looks like, it’s bound to come with unexpected challenges, so your organization must be prepared to absorb the costs.

• The cost of success. Maybe your organization started off as a local business but has expanded its scope as your products or services gained traction. With that expansion comes a larger customer base, and with that base comes mounting data sovereignty issues, particularly if your customer reach extends into new territories with different regulations. Data sovereignty must be a constant part of the equation when planning for expansion and growth, because ignoring it can bring significant legal consequences later on.

How to Support Data Sovereignty in Cloud Computing in 6 Steps

When it comes to data sovereignty, there is no single solution that works for every organization. However, several broad requirements are consistent regardless of an organization’s existing technology or business goals. The following six steps represent a general guide to potentially achieving data sovereignty.

1. Know what you're working with

How is your data stored? Where is it currently located and/or processed? Are you using a local data center, a cloud provider, or a hybrid of both? What role-based access and other security measures do you have in place? Do you use and/or need support for edge devices close to a jurisdictional boundary? And how will you expand down the line? Before making any decisions on data sovereignty, your organization must address these types of questions to get a full scope of what will drive compliance.

2. Know what you want

Did you answer questions above? Good, now take that information and consider what you need—and want—to do with it. Meeting regulatory compliance requirements is important, of course. However, given that the strategies involved will also impact your IT choices, your legal team, and your budget, you should also establish clear goals for business as part of the process. A general roadmap, a list of hardware and data needs, and best/worst case scenario assessments may all be key criteria to help build out your data sovereignty strategy.

3. Know what's available

In many instances, the intersection of your compliance, business, and operational needs will lead to a cloud solution. That may entail connecting an existing local data center via a hybrid model, migrating a local data center to the cloud, or considering the practical requirements for compliance against what a cloud provider can offer. Your organization should assess cloud vendors across technical, financial, and compliance-related needs, considering factors such as their migration services, physical data center locations, and service regions.

4. Make a choice—or several

By now, you will have understood your current situation, listed your specific needs, and explored the capabilities of different cloud vendors. Bringing it all together should create a clear shortlist of several vendors. Interview each vendor, and obtain a demo or trial if possible. Then it's time to select the vendor(s) necessary and build out a migration roadmap. As part of this step, you may thoroughly review each vendor’s service level agreements (SLAs) to find out how their services will align with your organization's functional needs.

5. Stay on top of changes

Functionality, security, and compliance—even after migration and launch, your organization may need to monitor key performance metrics and security issues to ensure that everything is going as planned. Regular audits may be a necessary part of today's data-driven business operations, as is factoring in regional updates and newly emerging laws. At this stage, your organization should also prepare for a worst-case scenario: what if you must cut ties with an underperforming vendor?

6. Revise as needed

If you’re not satisfied with your chosen vendor, know that there's always another option out there. Additionally, there are always new technological capabilities to leverage. Even if things are running smoothly for your business, it never hurts to consider what's out there, while factoring in the pain of migration, of course. Knowing all your options can be especially important if things go wrong with your contracted vendors—for example, if they don’t meet the performance standards set out in their SLAs, or if their customer service is lacking.

Whatever the case, reevaluation and revision should always be part of the plan when it comes to technology, and even more so when it involves data-driven economics and security.

Data Sovereignty Best Practices

While data sovereignty rarely takes the form of a one-size-fits-all solution, various best practices apply in nearly every situation. These may include the following:

• Know where your data goes. For storage, processing, and transmission, location matters. The first step to sound data sovereignty is identifying all physical locales. Once that list is generated, organizations can search for relevant regional laws to help verify compliance (or determine risks if non-compliant).

• Make smart choices about data localization. Data localization simplifies compliance and regulatory risk by ensuring that stored data physically resides in the jurisdiction where it was collected. In many cases, data localization may be the fastest way to achieve compliance, so this approach may eliminate many of the complications involved when data crosses international or state boundaries.

• Secure sensitive data. There's a difference between sensitive personal data and, say, general user metrics gathered by websites. Sensitive data, whether it's medical or financial or something else, may require proper safeguards to meet legal and ethical guidelines. Organizations may need to establish a policy specifically for managing and protecting sensitive data. To maintain compliance, businesses may consider conducting periodic reviews and updates of any policies created for this purpose.

• Vet your cloud vendors. Cloud storage offers significant benefits over local data centers, including speed, cost, and scalability. However, any organization that processes user data must be aware of where the data collection takes place. Since cloud providers could theoretically provide services to organizations all over the world, it falls to organizations to vet their vendors and ensure the right data residency options exist for regional compliance.

A critical and consistent aspect of the best practices listed above is the need to stay up to date on regional laws and regulations. Compliance is a dynamic and ongoing process, with new technology emerging and guidance continually evolving—sometimes very swiftly. Even once an organization has established its data sovereignty principles, ongoing validation and compliance are dependent on regular check-ins across all relevant regions and jurisdictions.

Address Sovereignty Requirements with Oracle Sovereign Cloud

To help organizations around the world address the many different data sovereignty requirements, Oracle offers a collection of Oracle Cloud Infrastructure (OCI) sovereignty solutions—deployment models designed to help address specific commercial and governmental needs with full OCI features. These offerings support customer control over data residency, access, and compliance accreditations for their organizations. In addition, Oracle National Security Regions help provide secure government networks for highly classified and sensitive workloads, while Oracle EU Sovereign Cloud can provide public cloud services, pricing, and programs in line with EU compliance needs.

Data Sovereignty FAQs

What is meant by data sovereignty?

Data sovereignty refers to the concept that the data laws of a specific jurisdiction apply to data stored and generated within its borders. Thus, the personal data of a user within a specific country is subject to the laws of that country. Similarly, if a cloud provider stores data within a different jurisdiction than its customer, multiple regulations may apply to the situation. In most cases, the responsibility for untangling and complying with these regulations falls on the organization that both acquires the data and pays the cloud provider for services, such as a tech company with a smartphone app.

What is an example including data sovereignty principles?

One of the most well-known examples of including data sovereignty principles is the EU’s GDPR. Conceived in 2016 and active since 2018, the GDPR applies to EU citizens, imposing regulations on personal data privacy, data collection, data protection, and usage of data in automation. The GDPR is often cited as the most influential data privacy law in existence.

Why is data sovereignty important?

In the era of floppy disks, data sovereignty was not discussed much due to the limited ability to transfer data. However, as connectivity and IoT devices have grown in capability, data is constantly being generated everywhere and transmitted across borders as well. Data sovereignty is important because it helps determine what companies are allowed to do with user data, most notably personal data collected via social media or financial data collected via banking apps. In addition, every device or website can present a potential privacy risk due to hackers, thus raising questions about who should be responsible for privacy and safety. Data sovereignty initiatives help establish clear guidelines, restrictions, and liabilities for the companies that are collecting, processing, and storing data.

What is data sovereignty in the United States?

The United States doesn’t have a single, all-encompassing data sovereignty law for its citizens. The Federal Trade Commission has the authority to investigate and prosecute organizations that fail to comply with privacy policies. On a state level, California’s CCPA covers many of the same areas as the EU’s GDPR, which is particularly important given the state’s substantial contribution to the nation’s overall economy—especially the tech sector. Other states such as Oregon, Colorado, and Virginia also have data privacy laws, with more states introducing bills of varying scope in recent years. Relatedly, many pre-GDPR questions regarding privacy and data ethics were raised with the introduction of the USA PATRIOT Act of 2001. It should be noted that the CLOUD Act of 2018 is related to data sovereignty. However, that law focuses on cloud service providers and their responsibility regarding data in the event that law enforcement agencies present warrants or subpoenas.