What is data sovereignty?

How the term is defined

There is no single agreed definition. A 2018 Government of Canada white paper describes data sovereignty as Canada's right to decide who can access its digital information and when it is disclosed, under Canadian law alone. It treats data residency as something narrower: where an organization's digital information is physically located.

A September 2026 World Economic Forum briefing paper calls the concept contested. It says governments, individuals, Indigenous groups, technology companies and others define it differently. The paper treats data sovereignty as a capacity that joins rights over data, technical control and accountable governance. It treats data localization (keeping data inside national borders) as only one tool.

The CARE Principles for Indigenous Data Governance, drafted at a November 2018 workshop in Botswana, address Indigenous peoples' control over the use of Indigenous data.

Why location is not enough

The Canadian paper says residency does not protect against the application of foreign laws. Its reason: a cloud provider with foreign operations could be required to comply with a foreign warrant or court order for the data.

The US CLOUD Act, enacted in March 2018, added 18 U.S.C. § 2713. The section requires covered providers to preserve or disclose data in their possession, custody or control whether it is located inside or outside the United States. Reuters reported in June 2026 that concern over that law is one driver of proposed European Union cloud rules.

As a safeguard, the paper says the government would direct that protected data in the cloud be encrypted and that it keep exclusive control of the keys. A 2025 Government of Canada framework paper likewise says storing data in Canada does not guarantee it is outside the jurisdiction of foreign courts.

Where things stand in 2026

The EU's Data Act has applied since September 12, 2025. The European Commission's explainer says the law protects non-personal data stored in the EU against unlawful access requests from foreign governments.

The Commission's Cloud Sovereignty Framework, dated October 2025, was written for a cloud tender. It rates cloud services from SEAL-0 to SEAL-4. It labels SEAL-2 as data sovereignty: EU law applies and is enforceable, but material non-EU dependencies remain.

The World Economic Forum paper describes sovereignty-washing: a vendor markets a service as sovereign while real control stays out of the customer's reach. It concludes that keeping data within borders is not enough.