Data Sovereignty

Data sovereignty means that data remains subject to the laws and public authority of the state having jurisdiction over it, even when it is stored or processed abroad. For cross-border digital services, it requires effective legal control over collection, use, transfer, access, security, retention and deletion. It is broader than data localization, which requires specified data or processing operations to remain within a territory.

Requirements for cross-border processing

Moving data across a border does not automatically remove it from the originating country's legal framework. A digital service must identify all applicable jurisdictions and build compliance into the entire data life cycle.

• The service should map data categories, storage locations, processors, subcontractors and onward transfers.
• A transfer must use the mechanism permitted by applicable law, such as transfer to approved destinations or safeguards prescribed by that jurisdiction.
• Contracts and technical controls should preserve security, auditability and regulatory access, including when foreign cloud providers process the data.
• The service must continue to honour applicable requirements concerning purpose, retention, deletion, breach reporting and individual rights.

Relationship with data localization

Localization can support sovereignty by keeping specified data or infrastructure within domestic territory, but it is only one possible instrument. Domestic storage alone may not ensure sovereign control if remote administrators or foreign legal orders can determine access.

• Cross-border processing can remain consistent with data sovereignty when domestic law permits the transfer and retains enforceable safeguards and oversight.
• A sound framework therefore considers legal jurisdiction, operational control and access to data, not merely the physical location of servers.

Indian legal illustration

For personal data, the Digital Personal Data Protection Act, 2023 illustrates how jurisdiction may extend beyond territorial processing.

• Under Section 3, the Act covers processing outside India when connected with offering goods or services to Data Principals within India.
• Under Section 16, the Central Government may restrict transfers of personal data by a Data Fiduciary to notified countries or territories.
• The Act also requires reasonable security safeguards and notification of personal data breaches, reinforcing accountability even within distributed processing systems.
• For AI and cloud services, compliance therefore requires tracing where training data, prompts, outputs, logs and backups are processed and transferred.

How UPSC asks this