Data Sovereignty

A term very near to Data Security and Data Privacy. Data Sovereignty is about keeping the data secure within the defined boundaries, especially e.g., certain sets of data should not go cross border for certain sectors.

In Data Security and Data Privacy, we make sure data is only accessed by those who need it or who own it. Within the organization, we maintain an ACL (Access Control List) to record the list of all the users with their level of access they can have on certain data sets. For example, which level of access developers can have, which level of access database administrators can have, which level of access department’s manager can have, which level of access a Business User can have, which of access Cost Centre person can have etc. So, in a way what we are trying to elaborate here is, there can be different levels of access granted to different level of roles in an organization to access data.

In Data Sovereignty, we make sure data remains within the country where it’s been generation i.e., if data is generated in Singapore, it should remain within the borders of Singapore. In other words, it’s the right of end users supported by regulatory bodies that their data should not leave their country. Well, we won’t go into details like what regulatory bodies requirements are, our aim is to understand what Data Sovereignty is.

Let’s understand with example, there are two types of infrastructure storages 1) On-Premises 2) On-Cloud. In on-premises solution, we have servers sitting within organization’s data centers. Data is not allowed to leave its network, even if employees want to access company’s applications from home, they must login via a VPN (Virtual Private Network) so the risk of losing data can be minimized. On-Cloud solution, big companies like Amazon, Microsoft, Google, Oracle, IBM, Ali Baba etc. host customers data/ applications in their servers in their own premises and make those available online where users can utilize storage, processers etc., as per their requirements. In other words, in Cloud, organizations don’t need to buy any hardware or servers, they can simply rent it from vendors like Amazon, Microsoft, Google, Oracle, IBM, Ali Baba etc.

Now, the question is how Data Sovereignty relates to On-Premises or Cloud?

With the introduction of Cloud, please note, as vendors like Amazon, Microsoft, Google, Oracle, IBM, Ali Baba etc., are renting their servers online, means customers data will be storing in vendor locations which can be within customer owns country or in vendor’s country. For example, Azure (Microsoft) is a USA based company and if customer in Singapore want to use Azure Cloud, means its data will leave Singapore boarder and will be stored in USA data center. This means Data Sovereignty has become a question mark. As mentioned above, Data Sovereignty definition is that data should not cross certain defined boundaries.

Now the confusing part, is Data Sovereignty is about data going cross border as a storage or if someone want to View it cross border then will that also be against Data Sovereignty? This line is very thin as this principle has yet to be brainstormed and agreed in different sectors.

To cater to the Data Sovereignty problem statement along with many others, vendors are opening data centers in different countries itself.

For me, if data is not stored outside define boundaries, then it should be fine. As far as Viewing is concern, we can’t limit it. Why? The response to that is, we all know when we open WWW (World Wide Web), we are going cross border so we can’t 100% run away from cross border concept but YES Data should not be stored cross defined boundaries. The solution is to store your data in your own region or within defined boundaries and access it via any BI tool anywhere around the World.