Published: 3 June 2024
Contributors: Mesh Flinders, Ian Smalley
Data sovereignty is the concept that data is subject to the laws of the country or region where it was generated.
Sometimes referred to as data residency, data sovereignty is fast becoming a core part of legal, privacy, security and governance strategies for enterprises that deal with the storage, processing and transfer of data. Having a strong approach to data management and international data flows—a key component of data sovereignty—helps organizations protect their most sensitive information from cyberattacks and other threats.
Data sovereignty, residency and localization are all closely related terms. In fact, data sovereignty and residency are so closely related that they are sometimes used interchangeably. However, there are some key differences that organizations seeking to use cloud computing capabilities as part of their digital transformation journey should understand.
Data sovereignty: Data that is stored and processed in the country where it was generated.
Data residency: Data that’s being stored in a different country from the one where it was generated.
Data localization: The act of complying with all applicable laws and requirements surrounding data residency.
Data sovereignty, residency and localization are all critical parts of a concept known as sovereign cloud, a type of cloud computing that helps organizations comply with the privacy laws of specific regions and countries where they gather, process and store customer data.
As cloud storage continues to spread around the globe, traditional geographic boundaries like borders aren’t sufficient to protect sensitive data. Also, the rise of data-intensive technologies like artificial intelligence (AI) and machine learning (ML) that depend on swift, secure data access is forcing enterprises to make more strategic decisions around cloud security. AI, specifically generative AI, have the potential to fuel valuable business innovations, but they need a fast, secure cloud infrastructure to function.
Enter sovereign cloud, a concept that includes data sovereignty, operational sovereignty and digital sovereignty. Sovereign cloud frameworks help enterprises build customer trust and grow their business while complying with the data collection, data storage and data privacy laws in the regions where they operate.
The Leadership Compass report from analyst firm, KuppingerCole, provides an overview of the Data Security Platforms market.
Subscribe to the IBM newsletter
The importance of data sovereignty is closely related to the growing importance of cloud computing environments in the overall growth strategies of many organizations.
As more enterprise applications move to the cloud, a cloud environment becomes critical infrastructure—as important to a company’s health as a factory, office building or valuable piece of IP.
Data sovereignty requirements typically surround the data privacy regulations in a specific country or region. Key concerns for organizations seeking to comply with local laws typically include cybersecurity, data security and privacy, protecting sensitive data from breaches and malware and controlling which individuals, entities and applications can access data.
For example, the European Union (EU) has a General Data Protection Regulation (GDPR) that requires companies operating inside EU territory and dealing with EU citizen’s data to hire someone known as a Data Protection Officer (DPO) to ensure that organizations strictly maintain the confidentiality, integrity and accessibility of data they generate, process and store.
Data sovereignty is determined by the specific laws and regulations that govern the region or country where data was generated.
These laws vary from territory to territory, but typically, when a country is said to have ‘‘sovereignty over’’ a piece of data, it means it holds jurisdiction and authority over how that data can be used and who can access it. However, often, data is subject to more than one country’s laws (data residency and data localization) and the governing, storage and processing of it becomes more complicated.
In cases where data is generated in one country or region but stored and/or processed somewhere else, the organization responsible for the data must ensure it follows all the legal requirements for handling data sets in both locations. For example, enterprises might find it necessary to generate specific data protection agreements or design and implement specific data transfer protocols to maintain compliance and avoid potential conflicts in one or multiple territories. Also, organizations storing and processing data in multiple regions or countries should be knowledgeable about any relevant data protection laws, cross-border restrictions or other concerns required to maintain data privacy and integrity.
To be effective, an organization’s approach to data sovereignty must also include two other critical components: operational and digital sovereignty. Together, data, operational and digital sovereignty are the three most critical components to sovereign cloud infrastructure. Operational sovereignty ensures that critical infrastructure is always available to individuals, entities and applications that need it, while digital sovereignty ensures that an organization is always in control of its digital assets. Let’s take a closer at both terms and why they’re important.
Operational sovereignty
Operational sovereignty ensures that critical infrastructure associated with data-rich applications is always-on and accessible. Also, operational sovereignty helps enterprises maintain transparency and control over their operational processes and spot inefficiencies.
With a sound approach to operational sovereignty, even if a particular region is affected by a disaster, an enterprise can ensure their critical infrastructure is resilient. Toward this end, many operational sovereignty approaches include a business continuity disaster recovery (BCDR) or disaster recovery as a service (DRaaS) plan. Finally, operational sovereignty helps enterprises comply with local regulations governing the infrastructure needed to support cloud environments in a particular region.
Digital sovereignty
Digital sovereignty describes an organization’s level of control over its digital assets, including data, software, content and digital infrastructure. Digital sovereignty is important to the concept of sovereign cloud primarily in the context of governance and transparency. Enterprises leveraging access control over their digital assets need to set rules around who has permissions and who is restricted. These rules need to be set up in a way in which they are easily enforceable, such as policy-as-code, a process that enables organizations to manage their infrastructure and procedures in a repeatable manner.
Transparency, another important aspect of digital sovereignty, refers to an organization’s ability to audit its processes and outcomes. Transparency ensures that organizations can see into their most important operational workflows so they can see what is working and what needs to be changed.
Broadly speaking, organizations looking to take a sovereign cloud approach to data sovereignty in a cloud computing environment have two options to choose from: public cloud or distributed cloud. In most countries, public cloud and multicloud deployments help organizations deploy their cloud workloads while still maintaining control over their data in a specific region. A typical public cloud architecture includes a platform cloud layer, like a hybrid cloud platform, that provides a stable, consistent cloud deployment.
The second option is the distributed cloud deployment model, such as a local infrastructure provider or on-premises data center. These are attractive for enterprises that require more control over their data. Essentially, a distributed cloud deployment model gives you the ability to deploy workloads and platforms into any infrastructure of your choice.
To get started implementing an effective approach to data sovereignty, organizations should take the following steps:
Enterprises looking to develop on-premises or cloud-based data capabilities in more than one region or country must first educate themselves on the laws and regulations governing data sovereignty in those territories.
It’s important to reach out to the agencies in charge of enforcing data sovereignty laws in the countries or regions you want to do business. Communicate your plans around data storage, processing and transfer to ensure you’re in compliance with the laws they are tasked with enforcing.
Compliance laws in many regions where cloud computing is popular can change quickly. It’s always a good idea to have someone in the country or region you’re storing and processing data who is an expert in the territories regulatory agreements. Cloud service providers (CSPs) that operate in a territory should already have agreements in place with the local authorities.
As citizens and regulatory bodies around the globe continue to raise data sovereignty concerns, sovereign cloud approaches are helping businesses ensure the integrity of their data no matter where it’s stored and processed.
In the coming years, how organizations gather, secure, store and control access to their data—especially if they are looking to tap new, data-rich technologies like AI and ML—will have enormous implications for growth and security. Data sovereignty is at the center of these concerns, so choosing a cloud provider that has a deep understanding of it will help businesses implement a strong sovereign cloud approach and achieve their digital transformation goals. Partners in regions and countries where enterprises seek to establish a cloud environment must have strategies to mitigate common risks like cyberattacks, natural disasters and downtime.
Finally, businesses looking to create a strong approach to data sovereignty and sovereign cloud must ensure their cloud provider has a strong overall cloud strategy that aligns with the laws of the countries or regions they operate in. Here are some of the most important features enterprises should look for when considering CSPs and other potential partners to help build a strong approach to data sovereignty.
Data governance capabilities: A CSP’s approach to data governance shows they have the right policies and procedures in place to successfully handle sensitive data and apply the necessary restrictions around it. They should also provide regular audits, proving the guidelines they’ve put in place are being followed.
Service level agreements (SLAs): When it comes to creating an SLA around data sovereignty in a sovereign cloud environment, the three most important areas the SLA should cover are control (cloud management), availability and performance.
Compliance: CSP’s and other partners helping enterprises comply with data sovereignty requirements should have a high level of expertise in all data laws in the regions where they operate. Ideally, enterprises and their CSPs should share responsibility for staying up to date with new regulations and developing strategies to deal with them.
Data encryption: It’s critical that CSPs in the sovereign cloud space have robust data encryption capabilities like cryptographic keys to ensure they can keep sensitive data safe and accessible. Cryptographic keys alter data into an encryption algorithm that can only be decrypted by someone with the right permissions (key.) This gives enterprises complete technical assurance and control over who can access their data and when.
Resiliency: A strong approach to data sovereignty and sovereign cloud environments should include strong resiliency features. Enterprises should only consider CSPs with proven track records of helping clients with resiliency and recovery efforts in relevant countries or regions. When it comes to a sovereign cloud environment, all cloud deployments should have built-in recovery and fail-over capabilities tailored to each, specific compliance area where data is being stored.
IBM Cloud® Hyper Protect Crypto Services is an as-a-service (aaS) key management and encryption solution, which gives you full control over your encryption keys for data protection.
Run smoother with deployment options for every workload. The IBM network is resilient, redundant and highly available.
Address unified security, compliance and risk visibility across hybrid multicloud environments.
Learn more about hybrid cloud, a cloud framework that combines and unifies public cloud, private cloud and on-premises infrastructure to create a single, flexible, cost-optimal IT infrastructure.
See how rapid advancements in cloud computing, data management and AI are making hybrid cloud integral to next-generation IT infrastructure.
Discover how hybrid cloud architecture, an environment that combines on-premises, private cloud, public cloud and edge settings, can help enterprises create a single, flexible managed IT infrastructure.
Discover more about data sovereignty. As the world continues to become a globally connected ecosystem, data fluidity has sparked national and international conversations around notions of data and digital sovereignty.
Learn more about data governance, a series of processes that promotes the availability, quality and security of an organization’s data through different policies and standards.
This webinar aims to guide organizations through the intricacies of data residency and equip them with actionable insights to meet regulatory demands effectively.