Data sovereignty

Data sovereignty is the principle that data is subject to the laws of the country where it is held. For file estates, it turns into a location question: which files sit in which jurisdiction, and which of them are subject to a rule that limits where they may travel. Answering that requires knowing where every file is.

Key takeaways

Some files may not leave the country where they are held.
Data residency is where the data physically sits.
For files, both become location questions answered from metadata.

Why does data sovereignty matter?

Because the laws of the country where data is stored decide who can demand access to it and how it must be protected. Storing personal or regulated data in the wrong country can break privacy rules such as GDPR, breach customer contracts, or expose the data to another government’s requests. It matters most for personal data, health and financial records, and government work.

What is the difference between data residency and data sovereignty?

Data residency is where data is physically stored, usually chosen for law, contract, or performance. Data sovereignty is the principle that data is subject to the laws of the country where it is held. Residency is the location, and sovereignty is the legal consequence of that location. For file estates, both start from the same fact: a record of which files sit in which jurisdiction.

How do you know which country your files are in?

By mapping each storage system to its physical location. For on-premises systems, that is the data center. For cloud storage, it is the region of each bucket or file share, which is recorded in its settings. A catalog that records the system and region for every file can then answer the question directly, such as which files with personal data sit outside the EU.