Digital & Data Sovereignty: Should I Be Thinking About What This Means?

Written By James Donovan

If you are a senior leader in any type of organisation today, the short answer is: yes. Digital and data sovereignty has moved from a niche subject to fulfil a compliance checkbox to a strategic risk that sits squarely across the c-suite and senior leadership.

What “digital and data sovereignty” Really Means

In practical terms, Data sovereignty is about where your data lives, who can access it, and under which laws it can be compelled. Digital sovereignty goes further: it’s your organisation’s autonomy over data, operations, software, and infrastructure within specific geographic and legal boundaries.

Gartner defines digital sovereignty as “ensuring autonomy over data, operations and technology, while enabling compliance with regulatory frameworks within specific geographic boundaries.”

And this autonomy is extremely important, it’s about control: who can give you access, read, move, or delete your data (including backups and logs). Ultimately, is is about whether your organisation can keep functioning if for any reason your vendor supply chain breaks down.

Why This Is Now A C‑suite Issue

The reason this is coming to the foreground now, is due to three major forces colliding:

Regulatory complexity: In 2026, 75% of the world’s population had their personal data covered by modern privacy regulations, and over 80% of organisations worldwide face modern privacy and data protection requirements. Regulations are multiplying and diverging by jurisdiction. Take the new EU AI Act for example, which will dictate that organisations declare if a candidates data has been parsed by AI during any step in the hiring process. If you don’t know where your data is at all times, how can you be sure you are compliant?

Geopolitics: Rising political tensions are driving uncertainty and extraterritorial legal risk. Global supply chains are being tested, stretched and even having restrictions imposed via export controls. Perversely, in an attempt to combat this, by 2028, it is expected that 65% of governments worldwide are expected to introduce some form of technological sovereignty requirement, in the event their supply chains are switched off from another region or by another government.

Cloud reality: Finally, organisations are realising that the perceived benefits of the cloud, including significant cost savings are in reality, extremely difficult to achieve. This is driving some organisations to look at their critical workloads, or the AI models that they run and determine if they can in fact be run better locally or in a private cloud.

This is not just an ‘IT’ problem, it affects the whole organisation and each functions continuity planning.

Which Organisations And Workloads Are Most Affected?

Sovereignty risk is not evenly distributed but nearly every organisation today and into the future will be affected. If your organisation can say yes to any of the below, it is affected;

  • Dependancy on any one digital or data supplier for key services (e.g. Microsoft, SAP)

  • Manages its customers IP (e.g. Law Firms, Professional Services)

  • Dependancy on core regulated systems across the public and private sectors

  • Handle sensitive customer and employee data platforms

  • AI/ML handling personal, health, or financial data

  • Cross‑border data hubs and shared services

  • Backup, DR, and logging environments that replicate globally

How Leaders Can Assess Their Own Risk

A pragmatic starting point is to treat sovereignty like any other enterprise risk: define appetite, measure exposure, then prioritise remediation. The “4+1” sovereignty framework is useful here, focusing on: Operations, Data, Software, Infrastructure & Communications, with Security as a cross‑cutting layer.

Ask, for each critical workload:

Data: Who can read, move, or delete your data (including backups, logs, and snapshots)? Where does it reside, and under which laws could it be compelled?

Operations: Could you keep running if your key suppliers/vendors were offline, sanctioned, or subpoenaed? What’s your real RTO/RPO under those conditions?

Software: Are your applications and IP portable? How hard would it be to exit or re‑host?

Infrastructure & communications: How dependent are you on foreign hardware, hypervisors, or network paths that could become single points of control?

Security: Are encryption, key custody, IAM, and trusted execution embedded across all layers?

The concept of geopatriation, moving workloads from global public clouds to local or sovereign environments has become a top 2026 trend precisely because many organisations are discovering hidden dependencies in these areas.

We will be publishing a follow-up later this week detailing three key steps your organisation can take to address these challenges, limit the risk exposure and build a plan to navigate this complex issue.

James Donovan