Data Sovereignty & Cross-Border Data Flows

Glossary

Adequacy decision

A determination by an exporting jurisdiction (notably the EU) that a destination country's data protections are essentially equivalent to its own, permitting data to flow there freely. Adequacy is frictionless but politically fragile and revocable.

Data localization

A legal requirement that specified categories of data be stored, and sometimes exclusively processed, within a country's borders. It ranges from a mild local-copy rule through conditional-transfer mirroring to hard localization that prohibits export outright.

Data residency

The operational fact of where data is stored at rest. Residency is often a voluntary design choice a firm makes to satisfy a customer or pre-empt a regulator, as distinct from a binding legal requirement to keep data in-country.

Data sovereignty

The principle that data is subject to the laws and jurisdiction of the country in which it is physically located. It reframes hardware as a piece of jurisdiction and underlies both localization mandates and cross-border transfer restrictions.

Important data

A category in China's Data Security Law defined by reference to national security and public interest rather than a fixed list. Its deliberate elasticity means ordinary commercial datasets can be reclassified as important and thereby locked in-country, creating open-ended compliance risk.

Sovereign cloud

Cloud infrastructure designed to satisfy data-sovereignty requirements, ranging from a simple in-country region, through operational sovereignty (in-country-only access), to full legal and structural sovereignty (locally incorporated operation insulated from foreign compulsion). It shifts infrastructure ownership but carries a price premium, feature lag, and continued fragmentation.

Splinternet

The fragmentation of the single global internet into distinct regional or national data spheres governed by divergent, sometimes incompatible, rules. It is driven by enduring state interests in security, economic advantage, and control, making it a structural feature of digital infrastructure rather than a temporary condition.

Standard contractual clauses (SCCs)

Pre-approved contract templates that bind a data importer to protective obligations, used to lawfully transfer personal data to countries lacking an adequacy decision. After Schrems II, firms relying on SCCs must also assess destination-country law and add supplementary measures where needed.