Data sovereignty

If a US company collects personal data from European customers, for example, the US organization must follow the specific data protection laws in Europe, like the EU’s General Data Protection Regulation (GDPR). Nations like China have personal information protection laws pertaining to data handlers and trusted parties. In the US, states like California and Virginia have their own consumer-focused acts. (Currently, there are almost 150 national data privacy laws.)

Why does data sovereignty matter to IT pros? If an engineer creates a pipeline that sends data across borders, new national mandates (like data-processing agreements or cybersecurity standards and notifications) are in play. Anyone picking the location of a data center, too, is also picking the location of additional data protection laws. In similar fashion, anyone choosing a third-party partner is subject to the partner’s data-sovereignty choices.

Common data sovereignty requirements include rules like:

• Organizations must process personal data in a secure fashion, have risk assessments, and not collect more data than necessary.
• Individuals must be empowered to control how their data gets used.

The already challenging sovereignty situation increases in complexity with cloud environments and AI.

• Cloud platforms send data across many different servers, for purposes of uptime and backup. IT pros relying on those platforms potentially need to know those data server regions. The US CLOUD Act, which allows US law enforcement to demand user data from American companies (even if that data is stored outside of the US) has led some EU leaders to prioritize storing critical data locally, away from cloud environments.

With AI, what if a large language model uses a US data center but trains itself on European customer data? Regulated companies trying in-house AI (and concerned with sovereignty) may choose to maintain dedicated private storage data lakes and repos to meet data-sovereignty demands.