Why data sovereignty has become a boardroom issue

Leaders are being asked a harder question: can we prove that our critical data is governed, protected, and accessible under the right legal, operational, and security conditions?
For organizations operating across APAC and other regulated markets, the answer depends on more than policy. It depends on having the right digital infrastructure, trusted cloud and cybersecurity services, and a governance, risk, and compliance (GRC) operating model that keeps pace with changing requirements.

Boards are paying closer attention to data sovereignty because data now underpins almost every strategic decision and operational process. A social networking company’s €1.2bil penalty (Source: Facebook owner Meta fined €1.2bn for mishandling user information | Data protection | The Guardian) for insufficient protection of user data during transfers from the EU to the US remains the biggest GDPR fine to date, proving data sovereignty concerns are no longer theoretical.

Customer data, operational data, risk information, intellectual property, third-party records, AI inputs, and compliance evidence are no longer passive assets. They are business-critical resources. If those resources are stored, processed, accessed, or transferred in ways that breach regulatory or contractual expectations, the impact can be significant.

• Data sovereignty is now a strategic risk issue, not just an IT architecture decision.
• Geopolitical tension, regulatory change, cyber threats, and AI adoption are increasing pressure on organizations to control where data lives and how it is governed.
• Sovereign cloud, secure connectivity, cybersecurity, and data governance all need to work together.
• GRC provides the operating model for proving that sovereignty commitments are being met.
• Orange Business and 6clicks help organizations connect the infrastructure layer with the governance layer — without turning sovereignty into a box-ticking exercise

Data sovereignty is often reduced to the question, “Where is the data hosted?”

Hosting location matters, but sovereignty is broader than that. A practical sovereignty strategy should answer four questions:

1. Location: Where is data stored and processed?
2. Access: Who can access it, under what conditions, and from which jurisdictions?
3. Control: Which organization, provider, or authority has operational control?
4. Evidence: Can we prove that policies, controls, and obligations are being followed?

The fourth question is often the hardest. Many organizations can describe their intended architecture, but struggle to prove that governance is operating continuously.

The pressure is coming from several directions at once.

1. Geopolitics is reshaping data strategy

   Governments are increasingly focused on national resilience, critical infrastructure protection, and control over sensitive information. As a result, organizations are being asked to show where data is hosted, who can access it, and which jurisdictions apply.

   For regional and global organizations, this creates real complexity. A cloud architecture that works for one market may not be appropriate for another. Geopolitical decisions can also affect an organization’s access to essential technology and data, not just its regulatory obligations. Data residency, sovereign cloud, and local compliance requirements need to be considered as part of business strategy, not just procurement.

2. Cyber threats are testing organizational resilience

   Ransomware, supply chain compromise, state-linked cyber activity, and attacks on critical infrastructure have changed how leaders think about digital risk.

   It is no longer enough to ask whether data is backed up or encrypted. Boards need assurance that critical systems are resilient, access is controlled, evidence is available, and incidents can be managed in a way that meets regulatory expectations.

3. Regulation is becoming more local, more specific, and more enforceable

   Across APAC and other regions, data protection, cybersecurity, critical infrastructure, and AI-related rules are becoming more detailed. Many of these requirements include expectations around data location, governance, third-party oversight, and evidence of control effectiveness.

   The challenge is not simply knowing which rules apply. It is maintaining a living view of obligations, controls, risks, and evidence across the organization.

   That is why infrastructure and GRC need to work together.

• Orange Business: trusted digital services and secure foundations

  Orange Business helps organizations design, build, and manage secure digital environments across areas such as:

  • Digital infrastructure and secure connectivity
  • Cloud networking and private or hybrid cloud
  • Cybersecurity services to anticipate, detect, respond, and protect
  • Data, AI, and data management
  • Digital trust and resilient infrastructure

  These services help organizations build the technical and operational foundation for sovereign, secure, and resilient digital transformation.

• 6clicks: sovereign-ready GRC and continuous governance

  6clicks helps organizations turn sovereignty requirements into manageable governance workflows. Teams can:

  • Map regulatory obligations to controls
  • Maintain risk registers and treatment plans
  • Collect and review evidence
  • Manage audits and assessments
  • Monitor third-party and supply chain risk
  • Report on compliance status across entities and jurisdictions
  • Deploy in models that support sovereign, hybrid, or restricted environments

  In simple terms: Orange Business supports the trusted digital environment, 6clicks helps prove that the environment is governed, controlled, and audit ready. While Orange Business provides expert human consulting and managed services in the design and operation of secure, trusted digital environments, 6clicks provides the single AI-powered system of record that unifies the risk data across teams. Together, this partnership helps customers move from a static GRC strategy to automated, sustained compliance with full visibility and zero operational burden.

If your organization is reviewing its data sovereignty, cloud, cybersecurity, or GRC strategy, start by identifying your most sensitive data, the jurisdictions that apply, and the evidence you would need to provide if challenged.

From there, Orange Business and 6clicks can help connect the infrastructure and governance layers, so sovereignty becomes part of how the organization operates, not just how it is documented.