What data sovereignty means

Data sovereignty is a simple idea wrapped in an intimidating word. It means the data your organization produces stays under your control: you decide where it is stored, who can see it, what is done with it, and when it leaves. Nothing about that requires you to run everything yourself. It requires that the choice remains yours rather than a vendor's.

Most organizations did not decide to hand control of their data to anyone. It happened one sensible purchase at a time. Each system came with its own storage in its supplier's cloud, and after a few years the most valuable records in the business are spread across accounts somebody else owns.

If your data lives in a third party's system, your leverage over it is only as good as your contract. That shows up at renewal, during a dispute, when a supplier is acquired, or when someone asks you where a particular record is and who has seen it.

• The primary copy of your data sits on infrastructure you control.
• It is encrypted and access controlled, with a clear record of who touched what.
• You can get all of it out, in a usable format, without asking permission.
• Your suppliers process your data. They do not own it, and they do not train products on it without your agreement.

Moving there does not have to mean rewriting your applications. That is what our secure storage is for.

The fastest way to find out where you stand is to ask your suppliers. We have written up eight questions and what a good answer to each sounds like.

What your obligations actually are depends on where you operate, whose data you hold and what your contracts already commit you to. This page describes the shape of the problem. Your lawyers can tell you what applies to you.