Explain data sovereignty and its implications.

• A. Data is subject to the laws of the country where it is stored; affects cross-border transfers and compliance
• B. Data sovereignty applies only to data stored on local devices
• C. Data sovereignty means data must be encrypted at all times
• D. Data sovereignty has no regulatory implications

Answer: (C)

Data sovereignty is about which laws and regulatory frameworks apply to data based on where the data is stored and processed. This means the country or region where the data physically resides can dictate how the data must be managed, protected, and who can access it. The implications include restrictions on transferring data across borders, requirements to localize certain data, and mandatory compliance with local privacy, security, and data-availability laws. Organizations must consider data placement, contracts with cloud or service providers, and how government access or data requests are handled under the relevant jurisdiction. While strong security practices like encryption are important, data sovereignty isn’t defined by encrypting data at all times; it’s defined by legal control and regulatory obligations tied to the data’s location. It’s also inaccurate to say there are no regulatory implications, since myriad laws govern data handling, cross-border transfers, and governance.