What is data sovereignty?

Data sovereignty is the ability to govern data under known laws and retain practical control over access, use, movement and deletion. It is broader than data residency, which describes location. A bank can keep data in Germany and still depend on a foreign provider, remote administrators or keys that the bank does not control.

A sovereignty assessment follows four questions: which law applies, who can access the service, who controls the technical dependencies, and how the customer leaves. Encryption helps only when key ownership and administrator paths are clear. Portability requires usable formats, documentation and replacement capacity. Governance assigns decisions and proves that controls continue after provider or geopolitical changes.

Banks apply the concept to customer records, payment data, risk models and confidential business information. Sovereignty does not require every component to be built in-house. It requires an informed choice about dependencies and a way to manage them. A multi-provider design can reduce one dependency, but it adds interfaces and operational work that need their own controls.

Marketing often reduces sovereignty to an EU data center. That leaves ownership, support access, software updates and supply-chain dependencies unanswered. Another risk is a paper exit with no tested target environment. Banks should test key rotation, privileged access, exports and continued operation during a provider outage. These controls also improve ordinary resilience when politics is not the cause.

GDPR, DORA, banking secrecy and outsourcing rules create concrete duties, while data sovereignty remains a broader control objective. Privacy, security and governance principles become data sovereignty requirements for access, keys, logging, continuity and exit. The difference between sovereignty and residency matters when contracts assign locations but not control.

BaFin and the ECB expect German banks to control ICT dependencies, the FMA does so in Austria and FINMA in Switzerland. The applicable legal details differ, especially outside the EU. Frankfurt combines supervisors, banks, exchanges and data centers, which makes it a major operating location. Local presence supports access and latency, but sovereignty still depends on group structure, technology and exit rights.