Analysis
Data sovereignty: from intention to architecture
Digital sovereignty translates into concrete, measurable and verifiable technical choices.
GSS Advisory team Published on 4 min read
Data sovereignty is often discussed as a principle. For a public body or a financial institution, it must become a set of documented architecture decisions.
Locate
Knowing exactly where data is stored and processed, including backups, logs and test copies.
Control access
Defining who can access data, from where, and keeping a verifiable record of that access, including for service providers.
Encrypt and hold the keys
Encryption only provides assurance if the organisation keeps control of the keys.
Preserve reversibility
Every contract and platform should allow data to be recovered in a usable format and suppliers to be changed without disruption.
