Data Sovereignty Framework DataSovereignty: Whose Server Is Your Data Actually Stored On?

Data Sovereignty Framework DataSovereignty: Whose Server Is Your Data Actually Stored On?

The United Nations Digital Cooperation Committee today released the Global Data Sovereignty Framework guidance document. The document systematically proposes, for the first time, three principles — data localization flexibility, data portability rights, and data sovereignty revenue rights — providing a reference model for countries developing data governance legislation.

The core question of data sovereignty is: when your personal data is collected by multinational technology companies, who does that data belong to? Where is it stored? Which country's laws govern it? Currently, over 140 countries worldwide have enacted some form of data protection law, but the lack of coordination among these laws leads to legal fragmentation in cross-border data flows.

The first principle proposed by the framework is "data localization flexibility" — it does not require all data to be stored within a country's borders, but critical infrastructure data and citizens' personal data must have local backups and be subject to national government jurisdiction in emergencies.

The second principle is "the right to data portability" — individuals have the right to request any data controller to export all their personal data in a standardized format and complete migration to another service provider within 30 days. This is more specific and mandatory than the EU GDPR's existing data portability right.

The third and most controversial principle is "data sovereignty revenue rights." This principle asserts that when technology companies use a country's citizens' data to train AI models and profit from it, those citizens have the right to share in a portion of the revenue. The framework recommends implementing this through a "data dividend fund" mechanism, funded by technology companies paying a percentage of their revenue.

Global technology companies have reacted differently. Apple and Microsoft have expressed "support in principle," as their business models do not primarily rely on data monetization. Google and Meta have expressed concern — if "data sovereignty revenue rights" are widely adopted, their global operating costs could increase by 5-10%.

Developing countries have broadly welcomed the framework. Ashwini Vaishnaw, India's Minister of Electronics and Information Technology, said: "For decades, citizens' data from the Global South has been freely accessed by Silicon Valley companies and converted into enormous profits. Data sovereignty revenue rights correct this unequal relationship."

Professor Urs Gasser, Director of the Berkman Klein Center for Internet & Society at Harvard University, commented: "The value of the DataSovereignty Framework lies not in its adoption by every country, but in its transformation of data sovereignty from an abstract concept into an actionable legal framework."

The framework is a guidance document and is not legally binding, but is expected to influence data legislation in at least 30 countries over the next two years.