Data Sovereignty
What is Data Sovereignty?
The concept that data is subject to the laws and governance structures of the country in which it is collected, stored, or processed.
Terms that appear alongside data sovereignty
Each of these is named in at least one of the same controls as data sovereignty. The number is how many controls name both.
- data protection 6 shared controls
- sub processor 5 shared controls
- certification 5 shared controls
- encryption 4 shared controls
- consent 4 shared controls
- gdpr 4 shared controls
- transparency 4 shared controls
- audit 4 shared controls
Frameworks that govern data sovereignty
What the standards actually require on data sovereignty
Requirements naming data sovereignty across 6 standards, quoted from the control text.
Sovereignty and cross-border movement requirements and rules are documented; a comprehensive set of controls is defined and approved;
edm-council-cdmc-cloud-data-management-capability-framework::1.4.2 · 1.4.2 Data sovereignty and cross-border data movement risks are managed →Article 12 of the Kazakhstan PDPL establishes the data localization requirement for biometric personal data of Kazakhstan citizens and residents - a key sovereignty provision strengthened by the 2022 amendment.
KZ-PDPL-Biometric-Data-Localization-Article12-Server-Kazakhstan-On-Soil-Data-Storage-Citizens-Residents · Kazakhstan PDPL Biometric Data Localization + Article 12 + Mandatory Server Storage in Kazakhstan + 2022 Amendment + Citizens + Residents + Foreign Cloud Provider Restrictions + Data Sovereignty + State Service for Information Security Oversight →The report addresses data sovereignty, offshore equipment and staff, and any information, including metadata, that is held or accessible outside Australia.
australia-irap-information-security-registered-assessors-program::IRAP-AR-0019 · IRAP-AR-0019 Cover data sovereignty and offshore elements →Sets the principle of data transfer (Art.18), the required level of protection in third parties (Art.19), conditions for cross-border transfer (Art.20), safeguards prior to cross-border transfer (Art.21) and data sovereignty considerations (Art.22).
ETH-PDPP-Art.18-22 · Cross-border transfer and data sovereignty →Annex A disclosure item (Data control) that a public provider completes for each cloud service: Where primary and backup data sit (Singapore, elsewhere in Asia Pacific, Europe, the United States or other regions), in how many countries the provider runs data c...
mtcs-singapore::A.5 · Disclosure: Data sovereignty →Data use has to respect international law and national sovereignty, which means States may regulate data created in or transiting their territory.
unesco-recommendation-on-the-ethics-of-ai::P10 · paras 46, 47 Multi-stakeholder and adaptive governance: respect data sovereignty, involve stakeholders across the life cycle and respect Indigenous data self-governance →Questions people ask about data sovereignty
What is Data Sovereignty?
Why is Data Sovereignty important for compliance?
Which compliance frameworks address Data Sovereignty?
Where can I learn more about Data Sovereignty?
See how Data Sovereignty applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.