Customer data glossary

Data sovereignty

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Data sovereignty is the principle that data is subject to the laws of a jurisdiction and that its owner, not a foreign provider or authority, controls access to it.

Part of the Learn hub and the customer data glossary.

What it means in practice

Data sovereignty has no single legal definition; it is a policy idea used in procurement and regulation. Four things are often bundled together: residency (where data is stored), jurisdiction (which law can compel access, including laws that reach a provider's parent company), operational control (who can administer the systems) and key custody (who can decrypt). A set-up can satisfy one and fail the others.

In the EU the debate has produced proposals rather than settled rules. The Commission published a Cloud and AI Development Act (CADA) proposal, COM(2026) 502, on 3 June 2026, with four assurance levels: Level 1 is self-assessment, Levels 2 to 4 involve third-party audit, and defence and law-enforcement users must use Levels 2 to 4 1. It is a proposal, not law, and its text may change in the legislative procedure (2026/0138(COD)). The linked article also covers the EUCS certification scheme, France's SecNumCloud and the sovereign offers of the large cloud providers.

For a customer data platform (CDP), sovereignty usually means a customer-owned deployment in the required jurisdiction, administered by the customer's staff or a local operator, with the customer holding the encryption keys. It also means asking where a vendor's support staff sit and which law governs the vendor.

Example (regional government): a government keeps citizen engagement data in its own data centre, run by its own staff, with keys held in its own hardware security module, so that no foreign provider can be compelled to hand data over.

Data residency: the location element.
Data localisation: the legal mandate form.
Customer-managed keys: the key-custody element.
Self-hosted customer data platform (CDP): customer-operated deployment.
Air-gapped deployment: the strictest form.

Where it matters

Sovereign customer data platforms: residency vs sovereignty vs jurisdiction: the full distinction.
EU cloud sovereignty framework and CADA: assurance levels and where to host.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Is a sovereign cloud the same as on-premise?

No. A sovereign cloud is a cloud service designed to meet jurisdiction and control requirements; on-premise is hardware you run. Either can meet sovereignty goals, and neither does so automatically.

Is data sovereignty a legal requirement?

Rarely as a standalone rule. Specific laws, sector regulators and public procurement rules impose residency, localisation or control requirements. Identify which apply to you.

Does residency give sovereignty?

No. Residency fixes location, not jurisdiction or operator control.

Sources

European Commission, proposal for a Cloud and AI Development Act (CADA), COM(2026) 502 Open source

This entry is general information, not legal advice.