Data sovereignty

Data sovereignty is the principle that data is subject to the laws, regulations and governance structures of the country or jurisdiction in which it is collected, stored or processed. For an organisation, it means being able to determine — and evidence — which legal regime governs its data at every point in its lifecycle, and ensuring that regime is one it can lawfully and acceptably operate under.

The concept matters for AI because using a hosted model can move data across borders in ways that are not always visible, exposing it to foreign legal processes, differing privacy standards or government access powers. Public-sector bodies, regulated industries and organisations handling personal or sensitive data increasingly treat sovereignty as a hard requirement rather than a preference, because a supplier’s contractual assurance does not override the laws of the jurisdiction where processing actually happens.

Data sovereignty is related to, but broader than, data residency. Residency concerns the physical location where data sits; sovereignty concerns whose laws apply to it and who can compel access, which can differ from location alone — for example where a provider is subject to extraterritorial legislation regardless of where its servers are. Deploying AI on-premises or in a controlled in-region environment is a common way to keep both the location and the governing law of the data firmly within the organisation’s control.