What Is Data Sovereignty?
Data sovereignty is the principle that data falls under the law of the jurisdiction with authority over it — and the observation that this jurisdiction is not always the one where the data is stored.
It is the question data residency does not answer. Residency says the disks are in Frankfurt. Sovereignty asks who can compel access to them, and the answer may involve a country the disks have never been in.
Why the Two Come Apart
Three mechanisms separate legal authority from physical location, and all three are ordinary rather than exotic.
The provider's home law follows the provider. A company incorporated in one country may face disclosure obligations there that reach data it holds anywhere. Building a data centre abroad does not place a subsidiary outside its parent's legal environment.
The customer's law follows the customer. An organization processing its own residents' personal data usually carries obligations that travel with the data wherever it is sent — which is why "our vendor is abroad" is rarely a defence.
Processing law follows the processing. Data that is transmitted for a moment to be worked on may become subject, for that moment, to the law where the work happens.
The practical consequence: a dataset can simultaneously be subject to two or three legal regimes with incompatible requirements, and no storage decision alone resolves that.
Sovereignty as a Procurement Question
When sovereignty appears in a questionnaire it usually stands for one of a small set of underlying concerns. Distinguishing them changes what a useful answer contains:
- Can a foreign authority compel disclosure? A question about the provider's corporate structure and applicable law.
- Can we satisfy our own regulator? A question about documented transfers and notifications, not about hardware.
- Can we exit? A question about portability and about who holds the encryption keys.
- Does anything cross a border at all? A question about the whole processing chain, including every subprocessor.
The fourth is the one most often answered with a fact about the first stage only.
The Chain Is the Answer
For a system that processes documents, the sovereignty answer is a list, not a sentence: storage provider, document converter, OCR service, model provider, and any queue or logging service that sees content on the way. Each entry has its own jurisdiction, and the weakest link sets the true answer.
At KTTC, uploaded documents and finished translations are stored in a Russian provider's object storage. Translation and field extraction call external model APIs, and scanned PDFs are converted through external document services. The storage stage and the processing stages therefore have different answers, and a claim covering only the first would not describe the system.
FAQ
Is sovereignty just residency with a longer word?
No. Residency is a fact about where storage is; sovereignty is a question about which legal authority applies. They frequently give different answers about the same data.
Does encryption resolve a sovereignty concern?
Partly, and only if the customer holds the keys. Encryption at rest under provider-held keys protects against theft of the disks, not against a lawful order served on the party holding the keys.
Does a local data centre make a foreign provider "sovereign"?
Not by itself. The relevant question is which entity controls the keys and the operations, and what law that entity answers to — not where the building is.
Where should a buyer start?
By asking for the processing chain rather than the storage location: every service that sees the content, and the jurisdiction of each. Data localization rules, where they apply, then attach to that list rather than to the storage claim alone.