Residency tells you where the bytes sit. Sovereignty tells you who can process, delete, and reach them. A four-dimension framework and a checklist mapping GDPR Article 28, CCPA, and EU AI Act Annex III to enforceable controls.
By
Billy Allocca
Table of Contents
Data Sovereignty vs. Data Residency: The Architectural Distinction Regulated Enterprises Cannot Afford to Confuse
Data residency is a location property: the jurisdiction where data is physically stored. Data sovereignty is a control property: whether your organization alone decides who processes the data, who can delete it, and who can reach it, with those decisions enforced by architecture you operate instead of by contract. A dataset can satisfy residency and fail sovereignty completely.
On June 18, 2025, Microsoft France's director of public and legal affairs was asked under oath by a French Senate inquiry whether he could guarantee that French citizens' data would never be handed to US authorities without French consent. His answer was "No, I cannot guarantee that" [1]. The data sat in European regions, so residency was satisfied. The gap was control, and the mechanism behind it is the US CLOUD Act, which obliges US providers to disclose data in their "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States" [2].
Buyers have caught up. In BARC's February to March 2026 survey of 320 companies, 51 percent rated data sovereignty as very important, up from 42 percent a year earlier [3], and Gartner found half of 2,501 surveyed CIOs outside the United States expect to change vendor engagement over regional factors, against 31 percent inside it [4]. The companion post on the SLM-first architecture for sovereign AI covers the model side; this guide covers the data side.
What Is the Difference Between Data Residency and Data Sovereignty?
Residency answers one question and sovereignty answers four. A region selection fixes where storage volumes live. It says nothing about whether the provider's staff, its parent company, its own model-training pipeline, or a foreign court can reach the data, and nothing about whether you can prove deletion when a regulator asks. Data localization is a legal mandate that certain data be stored within a country's borders, and it is the strictest form of residency: China's PIPL Article 40 requires large handlers to store personal information domestically and pass a state security assessment before export [5], and India's DPDP Rules, notified November 14, 2025, let a government committee name data categories that must stay in India [6]. Neither rule governs who processes the data once it is there.
Property | Residency guarantees | Residency does not guarantee | Sovereignty adds |
|---|---|---|---|
Storage location | Bytes sit in a chosen jurisdiction | That caches, backups, and indexes stay there | Per-dataset placement enforced at the storage layer |
Processing | Nothing | Who runs compute, or whether the vendor trains on your data | Engines you operate, under your policy engine |
Deletion | Nothing | That a delete purges every replica | Deletion you execute and audit yourself |
Access | Nothing | Immunity from foreign legal process against the provider | Identity and policy you own, logged in your estate |
What Is Data Sovereignty for Enterprises? The Four-Dimension Framework
A dataset is sovereign only when all four dimensions are under your control, and three out of four is a compliance exposure with a good marketing name. Processing sovereignty is your ability to decide which compute engines touch the data and whether any third party can run workloads against it without your instruction. Deletion authority is your ability to remove data, including replicas and derived artifacts, and produce evidence that you did. Access governance is a single identity and policy model that decides every read and write, human or agent, and records it in an audit trail, a tamper-evident log of who accessed what, when, and under which policy.
Dimension | Question it answers | Mechanism that satisfies it | Failure mode when absent |
|---|---|---|---|
Residency | Where do bytes, backups, and caches live? | Placement policy on object storage you control | Region pinned, but vector indexes replicate elsewhere |
Processing control | Who may run compute, and where? | Trino or Apache Spark you deploy, under your policy engine | Vendor pipelines and model training run on your data by default |
Deletion authority | Can you purge every copy and prove it? | Table formats with file-level manifests and snapshot expiry | "Soft delete" in a SaaS tier you cannot inspect |
Access governance | Who allowed this read, and is it logged? | One identity model, one policy engine, per-object enforcement | Separate IAM per tool; agents bypass human controls |
Vendors satisfy these dimensions separately, so the test has to be applied per dimension. AWS launched its European Sovereign Cloud in Brandenburg on January 22, 2026, with EU-resident leadership, EU-only DNS and billing, and a €7.8 billion investment, which addresses residency and part of operational control [7]. Critics noted in the same coverage that the entity remains wholly Amazon-owned, so the CLOUD Act question about the parent is unchanged [7].
Why Do Most Enterprise Data Platforms Pass the Residency Test and Fail the Control Test?
Cloud-era platforms were designed so the vendor operates the compute, the catalog, the optimizer, and increasingly the models, and that design is the control gap. Residency was easy to add because it is a placement setting. Control is hard to add because it requires the vendor to stop operating the layer that produces its margin.
Europe's regulatory record from 2023 to 2026 documents the gap in three places:
The EUCS cloud certification scheme carried a "sovereignty requirement" in its May 2023 draft (EU-only processing by providers headquartered and majority-owned in Europe). The March 2024 draft removed it after opposition led by the Netherlands, and as of November 2025 the scheme remained unadopted [8]. The Commission's follow-on Cloud Sovereignty Framework scores services on eight objectives on a 0 to 4 scale, and a service can hold the highest EUCS security level while scoring low on legal sovereignty [9].
Microsoft's June 2025 European offering commits to Europe-based processing, with remote access approved by Europe-based staff and logged in a tamper-evident ledger [10]. Parent-company legal exposure was, by the company's own testimony two days later, unchanged [1].
The EU Data Act, applicable from September 12, 2025, requires providers to disclose the measures they use to prevent third-country government access to non-personal EU data (Article 32) and phases out switching charges by January 12, 2027 (Article 29) [11]. The sibling guide on vendor-neutral data estates covers portability.
How Does Data Sovereignty Map to GDPR Article 28, CCPA, and the EU AI Act?
Every major regulation already asks a sovereignty question in the language of controller obligations, so the mapping has to be made explicit. The checklist ties each obligation to the dimension it exercises and the control that satisfies it in architecture.
Provision | Dimension | Enforceable control |
|---|---|---|
GDPR Art. 28(3)(a): processor acts "only on documented instructions from the controller," including third-country transfers [12] | Processing control | Compute runs under your identity and policy; vendor holds no standing credential |
GDPR Art. 28(3)(g): processor "deletes or returns all the personal data" and removes copies at end of service [12] | Deletion authority | Open table format with file-level manifests; deletion job you run and log |
GDPR Art. 28(3)(h): processor provides "all information necessary to demonstrate compliance" and permits audits [12] | Access governance | Central access log in your estate, queryable by your auditors |
CCPA Civ. Code 1798.100(d): contracts must limit purpose and grant the right to "stop and remediate unauthorized use" [13] | Processing control | Policy revocation that propagates to every engine at once |
CCPA regulations approved Sept. 23, 2025: risk assessments and ADMT obligations from April 1, 2027 [14] | Access governance | Per-request log of which model saw which columns |
EU AI Act Annex III: credit scoring, insurance pricing, recruitment, and essential-services eligibility are high-risk [15] | All four | One policy model governs training-data access and inference-time retrieval |
EU AI Act Art. 10(2): document "data collection processes and the origin of data," preparation, and bias assessment [16] | Processing control | Lineage from source table to model input, with access decisions retained |
The Article 10 row is where residency-only architectures fail hardest, because origin and preparation are processing questions. The sibling guide on EU AI Act compliance at the data layer works through Annex III in detail, and the guide on column-level security for AI agents covers the access-governance row at column granularity.
Why Not Just Sign a Stronger Data Processing Agreement?
A contract allocates liability after the fact; it does not stop a request the provider is legally compelled to honor. GDPR Article 28 itself carves out processing "required to do so by Union or Member State law to which the processor is subject" [12], and the CLOUD Act is such a law for a US processor [2]. The Microsoft testimony came from a company with mature DPAs in place, and the executive's added defense was that a disclosure "has never happened before" [1], which describes history and says nothing about capability.
A DPA also cannot deliver what the architecture does not support: it can promise deletion, but if the vendor's tier uses soft deletes you cannot inspect, the promise is unverifiable. BARC found 43 percent of companies now cite technical hurdles as the main obstacle to sovereignty, up from 26 percent in 2025 [3]. You still need the Article 28 terms. With a sovereign architecture, they describe a state you can verify, because compute, identity, and policy run in your estate.
NexusOne Enforces Sovereignty at the Query Layer
NexusOne is an AI-native data layer that sits horizontally across your estate and satisfies all four dimensions with one mechanism. Identity is federated from Active Directory, Okta, LDAP, or SAML into one Keycloak layer, so every human and every agent carries one identity everywhere. A policy is defined once in Apache Ranger and applied simultaneously to Trino, Apache Spark, Apache Kyuubi, and S3 object storage on a per-object basis. Tag a dataset in DataHub, map a role to the tag, and policies generate across bucket, schema, and table.
Processing control follows because the engines run in your Kubernetes on open formats such as Apache Iceberg, so no vendor pipeline holds standing access. Deletion authority follows from Iceberg's file-level manifests and snapshot expiry, executed under your identity and logged. Access governance extends to AI through the AI & Data Control Plane, which classifies each request at the boundary, redacts PII before any frontier-model egress, enforces per-role token budgets, and records every request. The same deployment runs identically on-prem, in your cloud, hybrid, or air-gapped, which turns residency into a policy you set. The post on one governance model for data and AI describes the boundary. To review your four-dimension exposure, book an expert consultation.
Key Takeaways
Residency fixes where bytes are stored; sovereignty fixes who controls processing, deletion, and access, and only the second protects you from compelled disclosure.
The CLOUD Act reaches data in a US provider's "possession, custody, or control" regardless of location, so EU-region hosting by a US-owned entity satisfies residency and fails legal sovereignty.
Test every dataset against four dimensions (residency, processing control, deletion authority, access governance); a pass on three is an exposure.
GDPR Article 28(3), CCPA 1798.100(d), and EU AI Act Article 10 each name a control that architecture can enforce and a contract can only promise.
One identity model and one policy engine, enforced across every engine and storage object in infrastructure you operate, is what makes sovereignty verifiable.
FAQ
What Is Data Sovereignty for Enterprises?
Data sovereignty is control over four things: where every copy of a dataset is stored, which compute engines may process it and on whose instruction, who can delete it and prove the deletion, and which identity and policy model decides every access. Residency covers only the first. A dataset hosted by a third-party platform in your home region can be resident and still fail sovereignty, because the vendor operates the compute and answers to its own jurisdiction's disclosure laws.
What Is the Difference Between Data Residency and Data Sovereignty?
Residency is a location property, usually set by choosing a cloud region. Sovereignty is a control property: whether your organization decides processing, deletion, and access, and whether systems you operate enforce those decisions. The US CLOUD Act shows the gap, since it obliges US providers to disclose data they control regardless of where it is stored.
What Does a Data Sovereignty Architecture Look Like for a CDO?
It keeps identity, policy, and compute in infrastructure you control, with data in open formats you can move: one identity layer you own (for example Keycloak), one policy engine (for example Apache Ranger) enforced across every query engine and storage object, Apache Iceberg tables for verifiable deletion, and a control plane that applies the same identity and policy to AI agents and logs every request. The test is whether you could produce the audit trail, execute a deletion, and revoke an access without asking a vendor.
How Does Data Sovereignty Relate to AI Compliance in Regulated Industries?
EU AI Act Annex III classifies credit scoring, insurance pricing, recruitment, and essential-services eligibility systems as high-risk, and Article 10 requires documented origin, preparation, and bias assessment of training data. Those are processing-control and access-governance obligations, which residency alone cannot meet. Your own policy engine deciding and logging what data each model and agent touched is how you produce the evidence these rules, and the CCPA automated decision-making rules that apply from April 1, 2027, demand.
References
Microsoft admits it 'cannot guarantee' data sovereignty. The Register. https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/
18 U.S. Code § 2713, Required preservation and disclosure of communications and records (CLOUD Act). Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/18/2713
Data Sovereignty 2026: From Compliance Topic to Prerequisite for Scalable AI. BARC. https://barc.com/news/data-sovereignty-2026-survey/
Gartner Survey Reveals 50% of Non-U.S. CIOs and Technology Executives Anticipate Changes to Vendor Engagement Based on Regional Factors. Gartner. https://www.gartner.com/en/newsroom/press-releases/2025-10-21-gartner-survey-reveals-50-percent-of-non-us-cios-and-technology-executives-anticipate-changes-to-vendor-engagement-based-on-regional-factors
Translation: Personal Information Protection Law of the People's Republic of China, Articles 40 and 41. DigiChina, Stanford University. https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/
Digital Personal Data Protection (DPDP) Rules 2025 Notified. India Briefing. https://www.india-briefing.com/news/dpdp-rules-2025-india-data-protection-law-compliance-40769.html/
AWS Launches European Sovereign Cloud amid Questions about U.S. Legal Jurisdiction. InfoQ. https://www.infoq.com/news/2026/01/aws-european-sovereign-cloud/
Technical is political: When a cloud certification scheme divides Europe. European Union Institute for Security Studies. https://www.iss.europa.eu/publications/briefs/technical-political-when-cloud-certification-scheme-divides-europe
Cloud Sovereignty Framework: How the EU is finally making cloud sovereignty measurable. SecureCloud. https://blog.securecloud.de/en/cloud-sovereignty-framework-eu-makes-sovereignty-measurable
Announcing comprehensive sovereign solutions empowering European organizations. The Official Microsoft Blog. https://blogs.microsoft.com/blog/2025/06/16/announcing-comprehensive-sovereign-solutions-empowering-european-organizations/
Regulation (EU) 2023/2854 (Data Act). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng
Art. 28 GDPR, Processor. gdpr-info.eu. https://gdpr-info.eu/art-28-gdpr/
California Consumer Privacy Act, Civil Code Section 1798.100(d) and 1798.140 (statutory text). Sidley Austin. https://www.sidley.com/en/sidley-pages/ccpa-text
California Finalizes CCPA Regulations for Automated Decision-Making Technology, Risk Assessments and Cybersecurity Audits. Skadden. https://www.skadden.com/insights/publications/2025/10/california-finalizes-cppa-regulations
Annex III: High-Risk AI Systems Referred to in Article 6(2). EU Artificial Intelligence Act. https://artificialintelligenceact.eu/annex/3/
Article 10: Data and Data Governance. EU Artificial Intelligence Act. https://artificialintelligenceact.eu/article/10/
