What is data sovereignty?
Data sovereignty is the idea that data falls under the legal authority of the country where it is collected, stored or processed. That country's privacy, security, law enforcement and disclosure rules apply to it, whatever the owner's home country. A company that keeps customer records in a data center in Germany is subject to German and EU law for those records, even if the company is headquartered elsewhere.
More than one jurisdiction often applies at once. The location of the servers matters, but so do the residence of the people the data describes and the nationality of the provider holding it. GDPR, for example, applies to organizations outside the EU that offer goods or services to people in the EU, and the U.S. CLOUD Act of 2018 lets U.S. authorities compel U.S.-based providers to produce data in their control even when it is stored abroad.
Data sovereignty vs. data residency vs. data localization
| Term | Question it answers | Example |
|---|---|---|
| Data residency | Where is the data physically stored? | A contract says EU customer data stays in EU cloud regions |
| Data localization | Does a law require the data to stay in the country? | Russia's law, in force since 2015, requiring citizens' personal data to be collected and stored in databases inside Russia |
| Data sovereignty | Whose laws govern the data? | EU law applies to records held in Frankfurt, and U.S. law may reach them if the provider is American |
The terms overlap, and many sources use residency and sovereignty loosely together. The useful point is that choosing a location is how an organization manages which laws apply.
Transfers between countries
Many laws restrict sending data out of a jurisdiction. GDPR allows personal data to leave the European Economic Area only under conditions such as an adequacy decision for the destination country, standard contractual clauses or binding corporate rules. These arrangements can change: in 2020 the EU's Court of Justice struck down the EU-US Privacy Shield in the case known as Schrems II, and in 2023 the European Commission adopted a new adequacy decision for the EU-US Data Privacy Framework. Regulators generally treat remote access from another country, such as an overseas support engineer viewing records, as a transfer too.
Example: choosing a cloud design
A German HR software company moves to a public cloud run by a U.S. provider. Pinning workloads to an EU region handles residency, but the company also has to place its backups, disaster recovery copy, logs and support tooling in the EU, check where each subprocessor stores data, and consider the provider's exposure to U.S. orders. Common mitigations are encryption with customer-managed keys held in the EU, provider sovereign cloud offerings operated within the EU, contract terms on government access requests, and a written transfer impact assessment.
Controls that support data sovereignty
- A data inventory showing where every copy lives, including replicas, caches and vendor copies.
- Cloud policies that block resource creation outside approved regions.
- Key management that keeps decryption keys within the required jurisdiction.
- Vendor due diligence and contracts that cover storage locations and subprocessors.
- Geofencing and conditional access that limit where data can be opened.
Data sovereignty on the CompTIA Security+ exam
In SY0-801, data sovereignty is one of the business considerations objective 3.1 weighs when choosing an architecture model, and objective 3.3 covers the related decisions about data location and placement. Wording such as "data must remain within the country", "customer records are subject to the laws of the nation where they are stored" or "a foreign government could compel the provider to hand over data" points to data sovereignty. Distractors include data classification, which rates sensitivity rather than jurisdiction; geofencing, which triggers policy on a device's location; encryption on its own; and high availability, when the scenario is about law rather than uptime.