Concept

What Data Sovereignty Means for Architecture

The Core Principle

Data is subject to the laws of the country where it physically resides. A user's personal data stored on a server in Germany is subject to GDPR — even if the company operating that server is based in the United States. This is data sovereignty: the data follows the law of the land where it physically sits.

Must be designed in from the start. Retrofitting sovereignty compliance into an existing single-region architecture is one of the most expensive engineering migrations a company can undertake. It touches every layer of the stack: storage, compute, networking, monitoring, CI/CD, and on-call operations. Building it correctly from the beginning costs a fraction of fixing it later.

Two Key Terms

  • Data Residency: Data must be stored in a specific geographic region. A backup of EU user data stored in us-east-1 is a compliance violation — even if the primary data is in EU regions. This applies to backups, replicas, data lakes, log archives, and analytics exports.
  • Data Localization (stricter): Data must not only be stored locally but also processed locally and cannot be transferred across national borders. An API request from an EU user that proxies through a US server for processing violates localization requirements even if the data is ultimately stored in the EU.

Every Architecture Layer Must Be Region-Aware

  • Storage: User data, backups, replicas, and archives must all reside in the user's assigned region. Automated backup policies that replicate to a centralized location must be overridden per-region.
  • Compute: PII processing — generating reports, running analytics, executing ML inference on user data — must happen in the same region where the data lives.
  • Data transfer: Pseudonymize or anonymize data before it crosses regional boundaries. Remove or hash PII fields before aggregating data globally.
  • User onboarding: The user's home region must be assigned at account creation — typically based on their location at signup — and is generally permanent. Establish this in the data model from day one.