Data sovereignty

Data sovereignty is the principle that data is subject to the laws and governance of the jurisdiction in which it is collected and processed, and, in practice, the ability of an organization to ensure that no foreign authority or foreign-controlled operator can access or compel access to its data outside that jurisdiction's law.

Sovereignty is stronger than residency. Data stored in Frankfurt is resident in the EU; if the operator is a US company, the operator may be ordered under the CLOUD Act (18 U.S.C. § 2713) to produce data in its "possession, custody, or control" regardless of where it is stored, which is a sovereignty problem that residency does not solve (Cornell LII, 18 U.S.C. § 2713). GDPR Article 48 answers from the other side by denying recognition to such orders without an international agreement (EUR-Lex, Regulation (EU) 2016/679). The conflict is what the cloud providers' sovereign offerings try to address through separate legal entities, local staff and operational independence; AWS describes its European Sovereign Cloud as "independently operated" with "sovereign assurances" and "legal protections," without detailing them on its overview page (AWS, Digital sovereignty in Europe, accessed 17 October 2026).

For an advertising stack, sovereignty is decided by four things: who operates the infrastructure, who holds the encryption keys, where the logs and identity graph live, and which partners receive raw data. A self-hosted or dedicated deployment operated by the data owner, with keys it controls and partners that receive only clean-room outputs, is the configuration that satisfies the strict reading. The argument is made at length in Data sovereignty defines the future of ad tech and the EU design in EU sovereign ad tech stack.

Example: a French bank's media network runs its bidder and clean room in its own data center with keys in its own HSM; an EU-based SSP receives bid requests with pseudonymous IDs; no US-controlled processor holds identifiable data. A CLOUD Act order to the SSP's US parent, if any, would reach only what the SSP holds.

Related: data residency, CLOUD Act, clean room, GLBA.

Source: 18 U.S.C. § 2713 (CLOUD Act); Regulation (EU) 2016/679, Articles 44 to 49.

1. Cornell LII, 18 U.S.C. § 2713
2. EUR-Lex, Regulation (EU) 2016/679
3. AWS, Digital sovereignty in Europe, accessed 17 October 2026