Data Sovereignty

Data Sovereignty is the principle that data is subject to the laws and governance frameworks of the jurisdiction in which it is stored or processed — and, at the individual or organizational level, the right to decide which jurisdiction that is. It spans two questions that are often conflated: the legal question of what a government can compel, and the practical question of where your data physically lives and who holds the keys to it. You can satisfy one without the other, and genuine sovereignty requires both.

Why jurisdiction matters

Cloud providers headquartered in the United States are subject to the CLOUD Act (18 U.S.C. § 2713, signed 2018), which can compel them to produce customer data stored anywhere in the world in response to a lawful US legal order, regardless of where the data physically resides. Renting a server in Montreal from a US-headquartered provider does not place your data under Canadian jurisdiction in any meaningful sense; choosing the provider is implicitly choosing the provider's legal exposure. Similar extra-territorial provisions exist in the laws of other major cloud jurisdictions. This is general legal context only and is not legal advice; consult a qualified attorney for guidance specific to your situation. The structural point stands regardless: data residency (where the disks are) and data sovereignty (whose law reaches them) are different things, and marketing routinely blurs them. See the CLOUD Act entry for the statute itself.

Keys, not promises

The second half of sovereignty is custody. Data encrypted with keys you alone hold is materially different from data a provider encrypts "for" you with keys they escrow — the first can only be taken from you; the second can be produced without your knowledge or consent. Bitcoiners will recognize this instantly as the self-custody principle applied to information: not your keys, not your data. The hierarchy runs from worst to best — plaintext in someone else's cloud, provider-managed encryption, client-side encryption to a rented server, and finally data on hardware you own, in a jurisdiction you have evaluated and accepted. Each step removes a party who can be compelled, breached, or simply acquired by someone with different values. The same logic extends to metadata: who you communicate with, when, and how often is frequently more revealing than the content itself, and metadata is precisely the layer that self-hosting reclaims and outsourcing forfeits.

The sovereign path

Genuine data sovereignty therefore means self-hosting what matters: your documents, your communications, your node, your models. It is the same layered project as digital sovereignty generally, and it extends naturally into compute sovereignty — because data you must send to someone else's AI to make useful is data you have surrendered at the moment of inference. For Canadian and Quebec operators the question has sharpened in recent years, as governments and enterprises alike confront how much of the national digital stack runs on infrastructure answerable to foreign law; our Canadian digital sovereignty resources cover the regulatory landscape and local alternatives, and the broader sovereignty hub maps the full self-hosting stack from communications to compute.

Sovereignty cuts both ways

Data sovereignty also has a generous face: publishing your own data on your own terms. D-Central's open data hub releases mining datasets under CC BY 4.0 — usable by anyone, hosted without jurisdictional lock-in or vendor dependency, an example of data made available rather than merely made accessible. Owning your data does not mean hoarding it; it means the decision to share is yours, revocably and on your terms. That is the whole principle in one sentence.

Related terms: Digital Sovereignty, Compute Sovereignty, CLOUD Act