Rethinking Data Sovereignty

Over the past few years, data sovereignty has become one of the most discussed topics in the digital economy. Governments are introducing stricter regulations, enterprises are reconsidering their cloud strategies, and CIOs are increasingly asked to guarantee that data generated within a country remains compliant with local legal frameworks such as the General Data Protection Regulation (GDPR).

In response, many organizations have adopted what might be called a territorial approach to sovereignty, with data relocated to national clouds, replicated across regional infrastructures, or confined within specific jurisdictions, to ensure regulatory compliance.

While understandable, this strategy often produces the unintended consequence of fragmenting the information landscape. This is because the more organizations that try to control where data resides, the higher the risk of creating isolated data environments.

This tension is not merely theoretical. Emerging initiatives around sovereign data sharing, particularly in European data space programs, have already highlighted how attempts to enforce sovereignty through infrastructure alone can lead to fragmentation and limited interoperability across organizations.

Data: Occurrence and Meaning

Yet the value of data rarely emerges when datasets are isolated from one another. It arises when data can circulate, combine, and generate insights across systems, organizations, and borders. This tension reveals a deeper issue: the debate on data sovereignty has focused on where data is stored, while the real challenge lies elsewhere.

Recent architectural approaches developed within initiatives such as the International Data Spaces Association demonstrate that sovereignty can be enforced not by relocating data, but by governing how it is accessed and used. In these models, data remains within its original domain, while usage policies, identity controls, and trusted execution environments enable it to be shared in a controlled and auditable way.

To understand how this works, it is useful to consider that data always has two different dimensions: occurrence and meaning.

The occurrence of data represents the concrete record generated by an event, like a financial transaction, a medical diagnosis, a sensor measurement, or a customer interaction. These occurrences are tied to specific contexts and often fall under the jurisdiction in which they are produced. They may contain personal information, sensitive operational data, or records whose management is subject to national regulations.

This dimension of data is commonly referred to as the extensional component, as it represents the extension of the concept, the actual instances that exist in systems and databases.

The meaning of data, however, is different from its occurrence, and it lies in the definitions, relationships, and conceptual structures that enable information to be interpreted. It is the semantic layer that tells us what a concept is and what it represents. This dimension is the intentional component, which concerns what data represents and, consequently, is what gives it interpretability.

Understanding this distinction lets us rethink sovereignty in a more balanced way.

The extensional dimension of data must remain sovereign. Data occurrences generated within a jurisdiction must comply with the legal and ethical frameworks that govern them. Citizens, institutions, and organizations have a legitimate right to prevent any information produced in their context from being misused or extracted without accountability.

But the intentional dimension of data should remain shareable. The meaning of data - its definitions, schemas, ontologies, and conceptual models - is precisely what enables information to circulate and become interoperable. Without shared meaning, data cannot travel far, and it becomes locked inside the system that generated it, understandable only within its original context.

A Critical, Delicate Balance

The future of the data economy therefore depends on maintaining a delicate balance: data occurrences must remain sovereign, but data meaning must remain open. Only under these conditions can information circulate while remaining respectful of its origin.

This distinction also reflects a growing emphasis in modern data architectures on different layers of interoperability. While technical and legal mechanisms provide control over data access, semantic interoperability enables that data to be understood across contexts. In other words, while the occurrence of data remains governed, its meaning must remain shareable.

When referring to the free circulation of data meaning, however, it is important to clarify that this does not imply the unrestricted sharing of all metadata associated with data. Regulatory frameworks such as the Data Act explicitly recognize that certain metadata, such as provenance, ownership, and usage policies, are themselves subject to governance and control.

Rather, what should remain shareable is the semantic layer that enables interpretation: the conceptual models, definitions, and relationships that enable data generated in different contexts to be understood and combined. In this sense, the circulation of meaning refers not to the uncontrolled dissemination of metadata, but to the ability to establish shared semantics without transferring or exposing the underlying data and its controlled attributes.

This principle becomes better understood when we consider a practical example.

A Healthcare Example

Imagine a multinational healthcare research initiative studying the early detection of cardiovascular diseases. Hospitals across Europe, Asia, and North America collect clinical data from millions of patients. These records contain highly sensitive personal information and must remain subject to strict national regulations.

No responsible healthcare organization would allow such data to be freely copied into centralized repositories located in foreign jurisdictions. Yet the value of this data lies precisely in the ability to analyze it collectively. Patterns of disease, treatment effectiveness, and risk factors often emerge only when data from many different populations can be studied together.

If every dataset remained isolated, medical research would progress far more slowly. The solution is not to move all the data into one place. Instead, it is to share how the data is understood.

Hospitals can agree on common definitions for clinical indicators, diagnostic categories, and patient attributes. These shared semantics enable researchers to run distributed analyses across multiple datasets without physically transferring the underlying records. Queries can be executed locally where the data resides, while only aggregated or authorized results are shared.

In this model, the sovereignty of data occurrences is preserved, while the circulation of knowledge remains possible.

Technological architectures increasingly support this approach. Logical data management platforms enable organizations to create a unified access layer across distributed data sources. Instead of consolidating data through replication, these platforms enable queries, policies, and governance rules to be applied across datasets that remain in their original environments.

This architectural approach effectively decouples data access from data location.

What makes these architectures particularly powerful is their ability to operationalize sovereignty at the level of data usage rather than data storage. This is achieved through policy enforcement mechanisms embedded in the data access layer: usage policies define who can access data, for how long, and under which conditions, while trusted interfaces enforce these policies at runtime. Queries are executed close to the data source, and only the authorized results are returned, often with additional transformations such as anonymization or aggregation. In this way, sovereignty becomes a programmable, auditable property of the architecture, rather than a constraint imposed by infrastructure.

Data can remain within the jurisdiction where it was generated, maintaining regulatory compliance. At the same time, organizations can expose controlled views of that data through a logical layer that enforces governance policies, masks sensitive fields, and regulates how information can be accessed.

The circulation of insights becomes possible without violating the sovereignty of the underlying data. But the implications of this shift go beyond architecture, and they touch on a broader question: how sovereignty itself should be interpreted in a digital society.

If sovereignty is understood primarily as a form of control - the ability to confine data within territorial boundaries - the result may be a fragmented digital world composed of isolated information islands. Innovation would slow, global collaboration would become more difficult, and the economic potential of data would remain partially unrealized.

A more constructive interpretation would see sovereignty not as a restriction on movement but as a guarantee of responsible circulation.

The Foundation of Data Democracy

From this perspective, sovereignty ensures that data moves within a framework of rights, transparency, and accountability. It protects those who generate data from exploitation, while still enabling the collective benefits that arise when information can be shared and interpreted across contexts.

In such an ecosystem, data does not flow without rules, nor is it constrained within rigid boundaries. Instead, information circulates according to shared governance principles that respect both its origin and its meaning.

In such an ecosystem:

• Data occurrences remain protected by the jurisdictions that produced them.
• Data meaning remains open enough to allow interoperability.
• Technology controls access without forcing data relocation.

Logical data management architectures, semantic interoperability frameworks, and distributed governance models, together, make this balance achievable.

In the end, the future of data sovereignty may depend on recognizing the simple but powerful idea that sovereignty should not be interpreted as the power to stop data from moving. It should be understood as the responsibility to ensure that data can move safely.

Only by protecting the sovereignty of data occurrences while sharing the meaning that makes them understandable can we build a digital ecosystem that is both innovative and trustworthy.

In this emerging paradigm, sovereignty is no longer enforced by isolating data, but by embedding control into the very fabric of how data is accessed, interpreted, and shared.

Such an ecosystem - which circulates data freely but never irresponsibly - may well be the true foundation of the emerging data democracy.