Security Insights · Data sovereignty · 9 min read
What Is Data Sovereignty? Residency, Localization and the Law
Data sovereignty explained: how it differs from data residency and localization, what Australian, US and Canadian rules say, and what to ask a provider.
When an organization moves files to the cloud, two questions decide its legal exposure: whose laws apply to that data, and who can be ordered to hand it over? For government agencies, law firms, health services and police, the answers shape privacy obligations, contracts and risk.
What is data sovereignty?
Data sovereignty is the principle that data is subject to the laws of the country where it is collected, stored or processed. It also covers who can compel access: a provider can be ordered, under the laws of any country with jurisdiction over it, to disclose data it controls, even when that data is stored in another country.
For example, patient files stored in Sydney are covered by Australian privacy law, and may also be reachable through US legal process if the hosting provider is subject to US jurisdiction.
Data sovereignty vs data residency vs data localization
The three terms answer different questions: where the data is, whether it must stay there, and whose laws can reach it.
| Data sovereignty | Data residency | Data localization | |
|---|---|---|---|
| What it means | Data is subject to the laws of the country where it is collected, stored or processed, and of countries with jurisdiction over its holder | The physical or geographic location where data is stored | A legal requirement that data be stored, and sometimes processed, inside a specific country |
| What it controls | Which laws apply and who can compel access | Where data and its copies are kept, usually by choosing a hosting region | Whether data may leave the country at all |
| Example | The US CLOUD Act requires providers to disclose data they control, wherever it is stored | An Australian agency's cloud contract names the regions where its data is stored (ISM control ISM-1572) | Australia's My Health Records Act 2012 (section 77) bars holding or processing My Health Record records outside Australia |
Residency is usually a contract or configuration choice. Localization is imposed by law. Sovereignty depends on both, plus the legal reach of everyone who handles the data.
Data sovereignty in Australia
The Privacy Act 1988 and APP 8
The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs). Under APP 8, before an organization or agency discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the APPs. Section 16C generally makes the Australian entity accountable for anything the recipient does that would breach the APPs.
The OAIC's APP 8 guidelines say that giving personal information to an overseas cloud provider only for storage may count as a use rather than a disclosure, if a binding contract keeps the entity in effective control.
The Hosting Certification Framework
The Hosting Certification Framework, released in March 2021, sets ownership, control and supply chain conditions for data center and cloud providers hosting Australian Government data. The Department of Home Affairs has run it since May 1, 2023, taking it over from the Digital Transformation Agency. Sensitive government data, whole-of-government systems and PROTECTED systems must be hosted using certified services.
The Information Security Manual
The Australian Signals Directorate's Information Security Manual (ISM) treats offshore hosting and foreign ownership as supply chain risks: foreign-owned suppliers operating in Australia may be subject to lawful access by a foreign government. Control ISM-1572 calls for contracts to document the regions or availability zones where data is processed, stored and communicated.
Data sovereignty in the United States and Canada
The US CLOUD Act
The Clarifying Lawful Overseas Use of Data (CLOUD) Act became US law on March 23, 2018, as Division V of the Consolidated Appropriations Act, 2018. It added section 2713 to Title 18 of the US Code: a provider of electronic communication or remote computing services must meet its US obligations to preserve or disclose data in its possession, custody or control, wherever that data is stored.
The obligation follows the provider, not the data center.
Under the CLOUD Act, Australia and the United States signed a data access agreement on December 15, 2021, which entered into force in January 2024. It lets agencies in each country send orders directly to communications providers in the other, without review by the receiving country's government.
Canada
Canada's federal Directive on Service and Digital requires departments to identify and evaluate computing facilities inside Canada as a principal delivery option for electronic data categorized as Protected B, Protected C or classified. A Government of Canada white paper on data sovereignty and public cloud adds that data residency does not protect against foreign laws that apply to a provider.
Why data location alone isn't enough
In-country storage settles residency, not sovereignty. Other factors decide who can reach the data:
- Who holds the encryption keys. If a provider can decrypt stored data, whatever it produces under an order can be read.
- Who operates the service. Under APP 8, giving an overseas contractor or parent company access to personal information, for example for technical support, is usually a disclosure, even if the data stays in Australia.
- Who owns the provider. Ownership affects which governments have jurisdiction over a provider, and is a core test in the Hosting Certification Framework.
- Where copies end up. Backups and logs may sit in other regions.
For a wider argument, read Why Data Sovereignty Can't Wait.
Does your data have to stay in Australia?
There is no single Australian rule that all data must stay onshore. Requirements come from specific laws, policies and contracts:
- Personal information: APP 8 permits overseas disclosure, with reasonable steps and ongoing accountability.
- My Health Record data: section 77 of the My Health Records Act 2012 bars the System Operator and registered operators from holding or processing records outside Australia, with narrow exceptions.
- Australian Government data: sensitive data and PROTECTED systems must use certified hosting under the Hosting Certification Framework.
- Contracts: the ISM calls for supplier contracts to document data regions and notice of changes.
Questions to ask a provider about data sovereignty
- Where is our data stored and processed, including metadata and logs?
- Where are backups and disaster recovery copies kept?
- Who can access our data, including administrators and subcontractors?
- Which countries' laws are the provider and its parent company subject to?
- Where are support staff located, and can they see our data?
- Who generates and holds the encryption keys?
- How much notice will we get before our data moves region?
How DekkoSecure approaches data sovereignty
DekkoCORE is hosted in-country, in Australia, the United States or Canada. Files and messages are encrypted with AES-256 keys on the user's device before they're uploaded, and each user's key pair uses ECC-384. Read how DekkoSecure handles security.
Common questions
Frequently Asked Questions
What is the difference between data sovereignty and data residency?
Data residency is the physical location where data is stored. Data sovereignty is about which countries' laws apply to that data and who can compel access to it. Data can reside in Australia and still be reachable under a foreign law if its provider falls under that country's jurisdiction.
Does the CLOUD Act apply to data stored in Australia?
The CLOUD Act applies to providers subject to US jurisdiction and covers data in their possession, custody or control, wherever it is stored. Data held in an Australian data center by such a provider can be within reach of a US order.
Does the Privacy Act require data to be stored in Australia?
The Privacy Act 1988 does not generally require personal information to be stored in Australia. APP 8 allows overseas disclosure if the organization takes reasonable steps to ensure the recipient complies with the APPs, and the organization generally remains accountable if the recipient mishandles the information. Specific laws, such as the My Health Records Act 2012, do set onshore requirements.
What is the Hosting Certification Framework?
The Hosting Certification Framework is an Australian Government policy, run by the Department of Home Affairs, that certifies data center and cloud providers against ownership, control and supply chain requirements. Sensitive government data, whole-of-government systems and PROTECTED systems must be hosted using certified services.
Does encryption protect data sovereignty?
Encryption doesn't change which laws apply to data, but it affects what a provider could hand over if ordered. Encryption limits compelled access only when the keys are kept away from the party receiving the order.