Key takeaways
- Is data sovereignty a legal requirement for your business
- How to build a data sovereignty strategy
- Sovereign data management in hybrid and cloud environments
Let’s imagine, for a moment, that you’re riding a mountain bike. You approach a stretch of particularly challenging terrain. In front of you are several paths you can take, each offering varying degrees of risk. Which do you choose?
You likely consider different factors. Your skill level. Appetite for adventure. Maybe even your health insurance coverage. Only then do you decide which route is for you.
This scenario isn’t so different from business. When facing potentially treacherous circumstances, leaders must always weigh the risks and rewards before deciding on a course of action that (hopefully) best serves the organization.
Which brings us to the issue of sovereignty. In our roles as a technologist focused on innovation and a corporate attorney, we’ve seen this discussion grow over the past few years. There’s real concern, and even fear, in the business community about making mistakes that might lead to serious consequences. That’s because there’s plenty of confusion along with agenda-driven misinformation and misconceptions about a topic that has rocketed into prominence.
This is what we tell business leaders. Sovereignty is not binary. It’s not black and white. Or yes and no. Sovereignty is a spectrum. And how you navigate this landscape is entirely up to you.
When you reach a fork in the road, what’s best for your business?
What Is Sovereignty, Really?
Lots of different phrases are getting tossed around. There are digital sovereignty, data sovereignty, operational sovereignty, AI sovereignty, and even technological sovereignty. The definitions can vary depending on the conversation. Ask 10 people what “sovereignty” means, and you’ll likely get 10 different responses.
Generally speaking, it refers to requirements that restrict the flow of and access to sensitive digital information to the countries where it’s physically created.
But there lies the ambiguity. Sovereignty is a continuum. What constitutes sensitive data, or how it needs to be protected, can be like beauty. It’s in the eye of the beholder. There are no laws that explicitly mandate sovereignty because it’s not defined. For this post, we will focus on data sovereignty.
To be clear, there are stringent privacy regulations, such as the GDPR (General Data Protection Regulation), the EU law that imposes limits on how organizations collect, store, and use data. And heavily regulated industries like healthcare and finance certainly have strict data rules, such as the DORA (Digital Operational Resilience Act) for financial institutions operating in the EU or CPS 230 (Cybersecurity Prudential Standard) in Australia. Also, critical Infrastructure laws and policies are increasing in number. Examples of governmental or state-sensitive data regulation include SOCI (Secure Operations Centre Initiative) in Australia and SREN Law (French law on digital space regulation) in France.
But sovereignty itself is generally not legally required. Sovereignty falls into a gray area, where it’s about business-driven choice rather than regulatory requirements. So, why such confusion? Geopolitics is the primary reason. There’s been a shift away from a “cloud-first” approach to data accessibility amid rising tensions between countries. For instance, European regions like France, Germany, and the Nordic nations are pushing to limit reliance on hyperscalers based in the U.S. to keep data within national or regional borders. The idea is to restrict potential U.S. governmental access to this data. In Asia and Oceania, we are seeing enterprises elect to hedge between Chinese and American hyperscalers.
Even though this is about protectionist trends rather than functional necessity, it has resulted in considerable (and understandable) trepidation throughout the business community.
So, what is a business to do? We’re glad you asked.
How Your Business Should Think About Sovereignty
When there’s a lack of widely adopted standards, legal definitions, and regulatory clarity for sovereignty, the burden falls squarely on individual companies to define their own policies across data, operations, and AI.
As with the mountain bike analogy, you need to decide on the most prudent path to take for the business. Here are points to keep in mind as you consider applying the appropriate sovereignty to your organization’s data management, as part of your risk and compliance framework.
- Understand your legal framework. Does your industry or country have hard requirements? What are your customers’ expectations?
- Audit your data estate. Categorize your data and decide what belongs in the “must-sovereign” bucket. For instance, should customer data that integrates with core systems be sovereign? Maybe that’s information that needs to be stored or processed on-premises or in a regional or sovereign cloud.
- Set your own policy. You’re in control. You get to decide the level of risk that’s appropriate for the business. Your assessment doesn’t have to be the same as other businesses.
- Be flexible in managing risk. Sovereignty is a moving target for every business. You need to be willing to re-evaluate your views on data residency and privacy as circumstances evolve. There may be laws, regulations, and formal standards ratified at some point.
The Boomi Enterprise Platform supports the principle of sovereignty without requiring complete data localization. In other words, you don’t need to hide precious data under your office desk, which is neither useful nor practical.
For example, we preserve control over core business processed data, such as intellectual property and personally identifiable information. Boomi’s lightweight runtime can be deployed anywhere — in the cloud, on-premises, or in a hybrid environment, while retaining full control over your business data processed through the runtime.
Data Without Borders
Safeguarding data has always been a high-stakes concern for businesses. But now it has become even more complicated to balance the variety of competing interests, legal regimes, and policies that apply in the wider data space, within today’s available technology infrastructure.
When we talk to business leaders, our goal is to help them see how the sovereignty piece of data management is a journey. It’s part of your operational risk matrix and how you, as an organization, view data residency and privacy. You can’t prioritize sovereignty first, because it could impede everything else you want to achieve with the most important aspect of your business: data.
You get to choose your own adventure — one that doesn’t end in a crash.