The myth of location-based data sovereignty
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
As governments and organizations rethink their reliance on foreign-owned IT infrastructure, data sovereignty has become a boardroom priority.
However, the conversation has become overly focused on where data is stored, overlooking the legal, operational and resilience factors that determine whether organizations are truly in control.
Whether through misunderstanding or a deliberate attempt to mislead, the term data sovereignty is often misused.
Data residency and data sovereignty are being conflated, despite being very different. Data residency is about the physical location of data, while data sovereignty is much broader and also includes legal jurisdiction, operational control, resilience, governance and the ability to manage risk.
Concerns about dependence on foreign-owned digital infrastructure have brought added urgency to issues of digital independence and control over critical technology.
In response, various vendors – particularly the big US-based hyperscalers – are now repositioning themselves with “sovereign” alternatives based primarily on where they store customer data.
While this might address some of their customers’ needs, reducing sovereignty to a question of geography creates a misleadingly simple narrative: if an organization moves data to the “right” country, it will somehow become compliant. In reality, the core issue is not just where data should be hosted, but understanding who may seek access to it and who ultimately controls the infrastructure supporting it.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
This misunderstanding is giving rise to what could be described as “data sovereignty washing”, with simplified claims that don't reflect legal or operational reality.
Governments the world over have well-established legal mechanisms for requesting information held in other jurisdictions. While data residency influences which laws apply and how requests are handled, it does not provide immunity from lawful access or eliminate international cooperation.
An example is the US CLOUD Act. Under certain conditions, it enables US authorities to request data from US service providers even when it is stored outside the United States. So, even if a UK or European-owned organization hosts data with a US-owned provider in a UK or European data center, it may still be reachable under US legal process. Being physically ‘local’ doesn’t change that.
The US is far from unique in this regard. Many other countries have legislation in place allowing authorities to access data for law enforcement or national security purposes, often supported by cross-border agreements and established legal processes.
The risk is that enterprises treat location as a complete sovereignty strategy, rather than one element of it. Threat actors care about the value of the data, not geography. As a result, organizations can spend significant time and money migrating data to new locations while leaving their biggest security risks fundamentally unchanged.
