Data sovereignty

Data sovereignty is the principle that data is subject to the laws of the country in which it is collected or physically stored, regardless of who owns the system it sits on or where that company is headquartered. It's a legal concept, distinct from where data actually sits, which is the narrower, more physical question addressed by data residency; a company can meet a residency requirement by hosting data in a given country while that data still remains subject to foreign legal jurisdiction if the hosting provider is headquartered elsewhere, and vice versa.

Sovereignty concerns often arise around foreign government access: a cloud provider based in one country may be legally compelled to disclose data to that country's authorities even when the data is stored on servers physically located in another country under a customer's residency requirement, a tension that has driven demand for sovereign cloud offerings run entirely by local legal entities.

Data sovereignty matters to analytics architecture choices, particularly for multinational and regulated organizations, because it can constrain which cloud providers and regions are permitted to touch certain personally identifiable information, and it interacts directly with regulations like General Data Protection Regulation that restrict cross-border data transfers. It's typically tracked through data classification and enforced under data governance. Obligations vary by country and data type, so this should be treated as general background, not a compliance determination.