How Data Privacy and Sovereignty Impact Business

More countries are adopting laws designed to protect the privacy of citizens and local entities by defining how data can be securely collected, stored, and used. Many organisations are re-evaluating how to comply with the changing geo-political landscape and privacy/security regulations, which requires defining some relevant concepts:

• Digital sovereignty – the ability to have full control over your own digital destiny – the data, hardware, and software that you rely on and create¹…in other words individuals owning their own data and controlling it’s use.
• Data residency – the physical and geographic location where data and meta-data is stored and processed.
• Data sovereignty – data is subject to the privacy laws and governance structures within the nation or jurisdiction where data is collected, stored, processed, and used.
• Jurisdiction – a legal authority over data centers and clouds aligned to national standards and supported by national government.

Data sovereignty laws are designed to protect the personal data of citizens or residents by controlling who can potentially have access. This keeps any sensitive data out of the hands of other countries and jurisdictions.

For example, the New York Times reports an executive order is in progress that is meant to prevent countries like China from gaining access to US data. Two other countries require that data on their citizens remain only within national borders.

To ensure data sovereignty, rules may require that all related data, such as metadata, also resides locally. But location of data alone isn’t enough to ensure that data is only subject to the local legal jurisdiction. Enterprises especially operating outside of the US in EU and other regions, are extremely concerned about the authority of the US Cloud Act. The 2018 US Cloyd Act allows US federal law enforcement to compel US-based technology companies to provide requested data stored on company servers, regardless of whether the data is stored in the US or on foreign soil.

That means complying with data sovereignty laws while using a US-based public cloud provider for sensitive data might not be possible or suitable to comply with local jurisdictional requirements. The Centre for European Policy Studies (CEPS) estimated that 92% of the Western world’s data is currently stored in the US and over 100 countries now have data sovereignty laws.

The European Union’s General Data Protection Regulation (GDPR) has inspired similar regulations in other jurisdictions. GDPR requires all businesses who operate in or have customers in the EU to change how they collect, handle, and store personal data.

With the ever-changing landscape of data protection laws, the increased risk of data breaches and evolving attack vectors there is growing concern about sensitive national, corporate, and personal data being subject to the control of foreign authorities and companies.

Organisations that run afoul of these laws risk fines or lawsuits. As of May 2022, over 900 fines have been issued for GDPR violations, the largest of which topped $877m (€746m).  The penalty for noncompliance can be steep, with fines of up to €20m (or 4% of worldwide turnover from the prior financial year).

Alongside protecting the way in which personal data is secured and used, many data sovereignty laws also restrict where data can go. For example, lawmakers in India are debating what types of citizen data are allowed to leave the country’s borders. This has caused issues for some multi-national companies who are unable to transmit data outside of a local jurisdictions. It can also impact international trade if data-sharing treaties between countries aren’t negotiated.

The effort to protect data as a new strategic asset is creating a clear need for sovereign clouds to secure and use data sensibly.

Customers want all the benefits of cloud but also need to meet the rapidly growing and changing data privacy laws while organisations need to protect data in the cloud against evolving cyberattacks.

As these laws impact business operations, organisations are seeking better ways to comply with data sovereignty laws and mitigate compliance risks. They need a way to store and process data locally and securely using a platform that is free from outside interference.

As a result of all this, the need for carefully architected sovereign clouds has gone mainstream and VMware is powerfully positioned to expand its multi-cloud strategy with VMware Sovereign Cloud.

The benefits of VMware Sovereign Cloud

A common benefit of sovereign clouds for cloud providers and customers is compliance. Cloud providers can obtain compliance with local regulations and their appropriate jurisdiction through the construction of sovereign clouds. Customers gain the assurance their privacy is maintained, and their data is stored, secured, and protected in their specific jurisdiction, by a partner with oversight and expertise in local laws and regulations.

Sovereign cloud providers can also accelerate local business growth by securely expanding into government data and developing a national capability for digital infrastructure and resilience. As the data economy becomes a vital national interest, sovereign states need a digital capability that prevents them from becoming dependent on foreign powers and operators for processing their own data.

VMware Sovereign Cloud providers can help customers fully unlock the true value of protecting their national, corporate, and personal data by ensuring:

• ALL data (customer data and meta data) remains on sovereign soil
• Compliance with established and constantly changing privacy laws
• Autonomy with digital suppliers to guarantee continuity of digital services
• All customer information is being managed appropriately with prevention from foreign access

VMware Sovereign Cloud providers offer a cloud service that is designed specifically to meet data sovereignty requirements. It provides flexibility and scale for data storage and processing while complying with residency and sovereignty requirements.

Find out more with the Sovereign Cloud Solution Brief or locate a VMware Sovereign Cloud provider today.