Data Sovereignty Isn't About Where Your Data Lives—It's About Who's In Control

Emma McGrattan is the Chief Technology Officer at Actian.

gettyIn June 2025, a French Senate committee asked a Microsoft executive if he could guarantee that data stored on Microsoft Azure in France would never be handed to U.S. authorities without explicit consent. He said he couldn’t. His answer confirmed that controlling where your data is stored is only part of data sovereignty. You also need to control who can access it, under whose authority and for what purpose.

I’ve spent much of my career helping organizations navigate changes in enterprise data architecture, from the days when they ran nearly everything themselves to today’s increasingly complex cloud and AI ecosystems. More recently, my work on data and AI sovereignty has brought a recurring concern into focus: Organizations often have far less control over their technology than they think. Splitting my time between Dublin and New York, I see the same challenge playing out on both sides of the Atlantic, even as the regulatory and political pressures differ.

​Many technology executives I speak with still reach for a map when I ask about their data sovereignty. But location alone doesn’t equal sovereignty.

So, how do you know whether your organization genuinely controls its data or simply complies with the rules governing where it resides? I’ll explore why traditional approaches to sovereignty are falling short, how AI is raising the stakes and what technology leaders should be thinking about as they build more resilient businesses.​​

Twenty years ago, most business-critical applications ran inside environments that organizations largely owned and controlled. Today, enterprise data flows continuously across cloud platforms, SaaS applications, integration services, partner ecosystems, AI models and autonomous agents. Every new integration introduces another dependency that sits outside the organization’s control.

In this environment, knowing where your data is stored tells you surprisingly little. A company may be able to demonstrate full compliance with every residency requirement. Yet, it still depends on cloud infrastructure, foundation models, identity providers, APIs and software platforms that it has little ability to influence.​

As we’ve seen, data residency in France alone can’t prevent U.S. authorities from demanding access to it. So, France is replacing Microsoft with a local provider as a step toward controlling the country’s own health data.​​

Over the past few years, external forces have continually reshaped technology ecosystems. Governments introduce technology restrictions with little warning. Cloud providers change licensing models and commercial terms. AI platforms release new capabilities and retire others at remarkable speed. Constant change is now the normal operating environment.​

That’s why I believe data sovereignty is an architectural property rather than a compliance initiative. Compliance proves that today’s requirements have been met. The architecture determines what an organization controls, what it depends on and how quickly it can respond when circumstances change.

• Technology Landscape: Map every system, platform and integration that touches critical data. Know what the organization controls, depends on and breaks if external services change or become unavailable.

• External Dependencies: Clarify the organization’s reliance on cloud providers, AI services, software vendors and other infrastructure.

• Critical Data: Identify business-critical systems, sensitive information flows and external services involved in decision making to prevent misallocating resources by risk area.

• Alternative Options: Identify alternatives for each critical service or technology. The range of options impacts the degree of resilience.

Successful organizations don’t apply the same level of control to every system. Identity systems, customer data and intellectual property require organizational ownership. Analytics and metrics on non-sensitive data may stay in the cloud. Decide what matters and build accordingly.​​

A 2026 BARC survey showed that a total of 89% of respondents consider data sovereignty either “very important” or “rather important,” but just 10% have budget for it. This tells me sovereignty is on the executive agenda, but the lack of dedicated funding means that they haven’t yet operationalized it.​​​

​AI is one reason why sovereignty has become urgent. In the BARC survey, increased use of data and AI in core business processes was the top-ranked driver of sovereignty initiatives, cited by 62% of respondents. The reason stems from the way AI reasons across data from multiple sources, infers new relationships and makes recommendations that previously required human judgment.​​

As organizations introduce autonomous agents into production, sovereignty extends far beyond where information is stored. It now includes where models execute, what information agents are permitted to access, which external tools they invoke, how their decisions are governed and whether those decisions can be reconstructed months later when someone asks why.

It’s hard to establish trust in the data used by AI. When an AI agent acts, organizations must know which data informed it and be able to explain the decision and how governance policies were applied. Without transparency, organizations can’t deploy AI responsibly at scale.

Organizations that invested in governance before generative AI became fashionable are further along in their AI journey. They know which data can be trusted, who owns it and how those governance policies are enforced. Instead of slowing innovation, their architectures allow new AI technologies to be adopted with confidence because they already have the guardrails in place.​​

The biggest misconception about data sovereignty is that it requires organizations to isolate themselves from the rest of the technology ecosystem. Complete independence has never been the objective. Modern enterprises will always depend on external technologies, partners and cloud providers. What matters most is maintaining meaningful control over critical capabilities and being able to pivot quickly if the need arises.

When data sovereignty comes up in your next board meeting, resist the urge to reach for the map. Instead, ask yourself: If one of our most important technology providers changed its commercial terms, exited a key market or simply disappeared tomorrow, how much of our business would continue to operate as it does today?

I suspect the answer will reveal far more about your organization’s sovereignty than any map of your data ever could.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?