A European retailer stores customer data in a data center located in another country. Its legal team explains that the data remains subject to the privacy laws of the customers' home jurisdiction regardless of where it is stored. Which concept does this describe?
Select an answer to reveal the explanation.
Short Explanation
Sovereignty is about whose rules apply, not where the hard drive sits. Your customers' data carries their home country's laws with it, like a passport, wherever it travels. Residency is the trap; that's the physical location question, not the legal one.
Full Explanation
Data sovereignty is the principle that data is subject to the laws and governance of a particular jurisdiction, commonly the one where the data subjects are located or where the data was collected, regardless of where it is physically stored or processed. A retailer that holds its customers' personal data in a foreign data center must still meet the privacy obligations of the customers' home jurisdiction, and may also face the laws of the country hosting the data center, which is why cross-border storage requires legal review. Data residency refers to the physical or geographic location where data is stored, often driven by a business or regulatory requirement to keep it in a specific region; it answers where, not whose law. Data retention concerns how long data is kept before disposal. Data minimization is the principle of collecting and keeping only the personal data necessary for a stated purpose. Exam caveat: the two terms are frequently paired, and some requirements combine them, such as a law that both governs the data and requires it to remain in-country. Operational check: maintain an inventory mapping each data store to the jurisdictions whose laws apply to its contents, and have legal review it whenever data is moved or replicated to a new region.