What is the difference between data sovereignty and data residency?
Data residency is the physical location where data is stored and processed, such as a cloud region in Frankfurt. Data localization is a legal rule that requires data to stay inside a country or region. Data sovereignty is the principle that data is governed by the laws of a particular jurisdiction, which in cloud computing comes down to one question: whose courts and authorities can compel the operator to hand the data over.
The three terms compared
| Term | Question it answers | Decided by | Example |
|---|---|---|---|
| Data residency | Where are the bytes? | Your choice of region, data center and backup location | “All production data is stored in EU regions.” |
| Data localization | Where must the bytes stay? | A law or regulation | A national rule that tax records stay in the country |
| Data sovereignty | Whose law governs the data, and who can force access to it? | The legal domicile and control structure of everyone who holds or operates the data | “No non-EU authority can compel our provider to disclose this data.” |
Residency is a technical property you can configure. Localization is an obligation someone imposes on you. Sovereignty depends on ownership, operations and keys, so it cannot be fixed by choosing a region alone.
Why server location and operator nationality both matter
Laws attach to people and companies, not only to places. The US CLOUD Act requires US-jurisdiction providers to disclose data in their “possession, custody, or control” regardless of whether it is stored inside or outside the United States (18 U.S.C. § 2713). The EU’s GDPR, in turn, treats remote access from a third country as a data transfer. The location of the server and the nationality of the operator each pull data into a legal system.
| Setup | Residency in the EU | Under EU law only |
|---|---|---|
| EU-owned provider, EU region, EU staff | Yes | Yes, unless the provider or its sub-processors have ties to another jurisdiction |
| US-owned provider, EU region | Yes | No: the US parent can be compelled under US law |
| Sovereign offering of a US provider, run by an EU entity | Yes | Depends on how much control the US parent keeps over operations, keys and software updates |
| Your own data center in the EU | Yes | Yes for the data, but software vendors and support contracts can still create dependencies |
A US-owned EU region therefore gives you data residency but not jurisdictional sovereignty. The details of that exposure are in does the US CLOUD Act apply to data stored in the EU.
Levels of sovereignty
Sovereignty is usually broken into layers, each with its own controls:
- Data or legal sovereignty. Which jurisdiction’s law applies to the data and to the company holding it.
- Operational sovereignty. Who administers the systems, from which country, under which employer, and who can approve access.
- Technical sovereignty. Whether you hold the encryption keys, can audit the software, and can move to another provider without rewriting your applications.
The European Commission’s Cloud Sovereignty Framework turns these layers into eight assessable objectives: strategic, legal and jurisdictional, data and AI, operational, supply chain, technology, security and compliance, and environmental sustainability. It scores each one from SEAL-0 (“No Sovereignty”) to SEAL-4 (“Full Digital Sovereignty”). How providers are graded against it is covered in what is a sovereign cloud.
Data localization in EU law
Inside the EU, localization is the exception. Article 1(3) of the GDPR states that “the free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.” For non-personal data, Article 4 of Regulation (EU) 2018/1807 states that “data localisation requirements shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality.”
The GDPR also does not require personal data to stay in the EU. It requires that transfers outside the EU and EEA rest on an adequacy decision or another safeguard in Chapter V. EU law sets residency conditions at the EU border, while member states can rarely demand storage inside their own territory. Germany is a typical case: see does German law require data to be stored in Germany.
Which one do you need?
- Residency is enough when your obligation is contractual or comes from a sector rule that names a location, for example “store in the EU or EEA”.
- Sovereignty matters when the risk you are managing is foreign government access, sanctions or a provider being forced to stop service. Then the questions are who owns the operator, who holds the keys and how fast you can leave.
- Localization applies only when a specific law says so. Check the law before accepting a contract clause that asks for more.
The long-form guide to cloud sovereignty, data residency and portability covers the regulations and provider options in more depth.
Where Cloudfleet stands
Cloudfleet’s Security and data protection page lists every type of cluster data, the region it is stored in, who operates it and which infrastructure provider hosts it. Customers who need keys outside that provider can use Confidential Control Plane on Enterprise clusters.