{"id":53870,"date":"2026-10-08T16:59:35","date_gmt":"2026-10-08T20:59:35","guid":{"rendered":"https:\/\/eficio.ca\/?p=53870"},"modified":"2026-10-08T17:01:14","modified_gmt":"2026-10-08T21:01:14","slug":"data-sovereignty","status":"publish","type":"post","link":"https:\/\/eficio.ca\/en\/blog\/data-sovereignty\/","title":{"rendered":"Data sovereignty has four dimensions. Your provider may only cover one."},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\"Alain\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t
Alain Marchildon<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t
President of Eficio<\/span><\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Data sovereignty has four dimensions. Your provider may only cover one.<\/span><\/strong><\/h1><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ask five executives what they mean by data sovereignty. Yet you will get five answers. The first one thinks of a server in Montreal. For the second, it means compliance with Law 25. The third wants a Quebec provider. The fourth thinks of cybersecurity instead. As for the fifth, he hasn\u2019t decided yet.<\/p>

None of them is wrong. But none of them has the whole answer.<\/p>

The term has made its way into calls for tenders, cloud brochures and board meetings. Yet no one has given it a common definition. A provider can therefore call itself sovereign because its servers are in Canada. Its parent company, however, may still answer to a foreign law such as the CLOUD Act<\/a>, which forces it to hand over your data on request.<\/p>

In my view, data sovereignty is a level of control. More precisely, that control is measured along several axes.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

What are the four pillars of data sovereignty?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

At recent conferences, I was able to summarize the following four pillars. Each one answers a different question. In fact, the same provider can be strong on one and weak on another.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t

The four pillars of data sovereignty: location, operational, legal and technical sovereignty.<\/em><\/p>\n\t\t\t\t

\n\t\t\t\t\t

1. Data location: where is your data, and where can it go?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This is the pillar everyone knows, and the one most poorly assessed. Indeed, the question doesn\u2019t stop at where the data is hosted. It also covers where the data travels and where it gets copied. You also need to know where the backups sit and where support access comes from. For example, a database hosted in Montreal but copied to Virginia for recovery does not stay in Quebec. Likewise, an event log sent to an American monitoring tool leaves Quebec.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

2. Operational sovereignty: who runs the environment?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Your data can stay in Canada while teams located elsewhere manage it. Think of the people who run the servers and apply the patches. Also add those who handle support tickets and hold privileged access. All of them are part of the equation. Thus, an administrator access opened from abroad amounts to a transfer, even if not a single byte moves.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

3. Legal sovereignty: which laws does your provider obey?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This is the most often ignored pillar, and the most decisive. The American CLOUD Act dates back to 2018. It requires any cloud provider subject to U.S. law to disclose the data in its possession, custody or control. In other words, it doesn\u2019t matter whether that data is in the United States or elsewhere. The hosting location therefore changes nothing to that obligation. What matters is the legal regime that governs the provider and its parent company.<\/p>

In June 2025, a French Senate commission of inquiry<\/a> questioned the director of public and legal affairs of Microsoft France under oath. The senators specifically asked him for a specific guarantee. Could Microsoft commit to never sending French citizens\u2019 data to the U.S. government without the consent of French authorities? His answer: \u201cNo, I cannot guarantee it, but, again, it has never happened.\u201d (Translated from French.)<\/p>

In fact, the answer is honest. But it also sums up the whole problem of data sovereignty.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

4. Technical sovereignty: how much control do you keep?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The fourth pillar measures your ability to keep technical control over your data and services. It also assesses your ability to reduce your dependence on a provider.<\/p>

Several questions help assess it:<\/p>