Speaking about applicable laws and regulations to certain data and information, there is a term called ‘data sovereignty’ or ‘information sovereignty’. In this case, since you’re ASKING about data, the first expression will be capitalized.

Basically, it is subject to numerous laws and regulations of the country in which the data is located or stored, used and transmitted – both sent and received.

Since those early days, it’s been one of the key challenges when an INDIVIDUAL/organization wants to move into the cloud, the GOVERNMENT/authority insist that the data should never leave their jurisdiction, which directly means we couldn’t place it in our desired services.

Thus far, there is no international policy, standard, or agreement which provides one set of data sovereignty’s requirements that all countries should be following.

Day in day out, it gains more weight and in response, many countries have established and regulated compliance requirements by amending the current laws or enacting new legislation that requires customer data kept within the country it resides. Over the past few years, this kind of obligations has been lately enforced in Vietnam, Brunei, Iran, China, Brazil, India, Australia, South Korea, Nigeria, Russia and Indonesia.

Additionally, the laws and regulations vary by country whilst some are, in fact, stricter than the others. Some of them mandate their citizens’ data is stored on physical servers within the country’s physical borders. Australia, for example, commands the provider to reveal what information is being sent outside the country.

In addition to that, the European Union (EU) restrict the transfer of Personally Identifiable Information (PII) to countries outside their member countries. PII itself is the type of data that could potentially identify a SPECIFIC individual and refers to a relatively narrow RANGE of data such as name, address, birth date, credit card number or bank account.

What You Could Do You’d better know the storage, server and any other device where your data will reside, what’s in the fine print, whether the provider has already complied to data sovereignty laws in the country where your data is located at. If your government body requires you to, in this context, store your data at the country where you are based, make sure two things. First, the provider has its’ storage deployed there. Second, their obligations to applicable laws and regulations on data sovereignty are already fulfilled.