Data Sovereignty
Data sovereignty is the principle that data is subject to the laws of the jurisdiction where it is collected, stored or processed — and, in practice, to the laws of every state that can compel the company holding it. For a fintech or AI business it decides where data may sit, who may handle it and who can demand it.
- Also known as
- National data sovereignty, Data jurisdiction, Jurisdictional control of data
- Related terms
- data residency is where data is physically stored; data localisation is a legal requirement to keep it in a country; sovereignty is the question of whose law applies and who can compel access
- EU rules
- the GDPR restricts transfers of personal data outside the EU (Articles 44–49), with fines for breaches of up to €20m or 4% of worldwide annual turnover, and refuses to recognise foreign court orders for data unless based on an international agreement (Article 48)
- US reach
- the CLOUD Act (2018) lets US authorities compel US-based technology companies to produce data they hold, whether it is stored in the US or abroad
- Transatlantic transfers
- the Court of Justice struck down the EU–US Privacy Shield in Schrems II on 16 July 2020; the Commission adopted the EU–US Data Privacy Framework on 10 July 2023, and privacy campaigners have contested it since
- Localisation
- India's central bank directed in April 2018 that payment system data be stored only in India, while data on the foreign leg of a transaction may also be stored abroad
- Non-personal data
- the EU Data Act, applicable from 12 September 2025, obliges cloud providers to take measures against unlawful third-country government access to non-personal data held in the EU
How data sovereignty works in practice
The practical question is not where the servers are but who can be compelled. A European neobank that keeps every customer record in a Frankfurt data centre run by a US cloud provider has solved residency, not sovereignty: the provider is within the reach of the CLOUD Act wherever the data sits. Firms respond in layers — contractual commitments from the provider to challenge requests, encryption with keys held in their own hardware security modules so the provider stores only ciphertext, "sovereign cloud" services operated by locally controlled entities, and, for the most sensitive workloads, local providers or their own data centres.
AI multiplies the question. Training data, prompts, retrieved documents and model outputs can each cross borders, and a model hosted by a provider in another jurisdiction may process customer data every time it is called. Banks now ask where inference runs, whether prompts are retained, and under which law the model provider operates.
For a buyer, data sovereignty is a diligence workstream. The data map — which data sits where, under whose control, transferred on what legal basis — decides whether the target can keep serving its customers after the deal, whether a foreign acquirer changes the analysis, and what migration the integration plan must fund. A target that cannot produce the map usually does not have one.
Example
A payments start-up processes transaction data for 400 merchants in the EU and India, all on one US cloud provider's region in Ireland. An acquirer's diligence finds three problems: Indian payment data is stored in Ireland, contrary to the RBI's local-storage direction; transfers of EU personal data to a US analytics vendor rest on standard contractual clauses nobody has reviewed since Schrems II; and the fraud model is trained on data from both regions in a single US pipeline. The remediation budget is €1.2m to stand up Indian hosting and migrate 18 months of records, €150k of legal work on the transfers, and €20k a month in extra compute to split the training pipeline by region. The acquirer holds €2m in escrow until an auditor certifies the Indian migration.
Common mistakes
- Equating residency with sovereignty: an EU data centre run by a US provider is still within US legal reach. - Assuming the EU–US Data Privacy Framework is permanent; both of its predecessors were struck down. - Encrypting the data and letting the cloud provider hold the keys. - Mapping the production database and forgetting backups, logs, support tools and AI prompts. - Treating a change of owner as neutral, when a foreign acquirer can change which governments may compel access.