Data sovereignty isn’t really a technology discussion. It’s becoming a geopolitical one.
You can no longer rely on global trust.
That assumption is weakening.
Your most sensitive data is one of your organisation’s strategic assets. Don’t let ambiguous language define how it’s protected.
Over the past 20 years, many of us optimised for efficiency because we assumed global trust. Just-in-time deliveries, cloud platforms unhindered by jurisdiction, and globally integrated supply chains all relied on that assumption. That trust is breaking down, and many countries, and soon many organisations, are going to have to consider what that means for them.
“Data sovereignty” can mean many different things. Which of the following does it mean to you?
- Does it mean the data is stored in-country?
- Does it mean only local engineers administer it?
- Does it mean encryption keys never leave your jurisdiction?
- Or does it mean no foreign government can legally compel access?
The phrase “data sovereignty” is meaningless until everyone in the room agrees what it actually means.
Ask five different vendors and you may well get five different answers.
The US CLOUD Act illustrates that the physical location of a server isn’t the only question. Legal jurisdiction matters too. The EU may ultimately move in a similar direction. History suggests governments rarely seek less access to strategically important data.
This isn’t an argument against cloud. Public cloud remains an extraordinary platform.
It is an argument for classifying data according to geopolitical risk as well as technical risk.
For many organisations, that probably means asking different questions about:
- PKI
- Encryption keys
- Privileged identities
- HR systems
- Financial systems
- Core intellectual property
The answer is unlikely to be “everything on-prem” or “everything in the cloud.”
Increasingly, it’ll be both.
If your board asked you to define “data sovereignty” in one sentence, could everyone in the room agree on the answer?
richsec.blog 