Organisations lack data sovereignty strategy despite geopolitical risks

Almost two-thirds of large organisations have yet to formally embed a data sovereignty strategy, despite nine in ten regarding sovereignty as a business concern, according to new research from Everpure.

The research, conducted by Vanson Bourne, included public sector organisations as well as businesses across sectors including financial services and manufacturing.

The firm describes the UK as one of the firm’s “strong public sector markets”. Customers include Ordnance Survey, Scottish Government ARE Directorate and the University of St Andrews.

The research found 64 percent of organisations had not formally embedded a data sovereignty strategy, while 62 percent lacked full visibility into who could access, control and manage their data. More than half – 56 percent – said they lacked the skills, staff or capacity to deliver sovereignty initiatives.

Speaking at Everpure’s Accelerate event in London, Patrick Smith, field CTO, EMEA at Everpure, said organisations were having to think differently about sovereignty as regulation, geopolitical uncertainty and reliance on external technology providers created new risks.

“Whereas organisations previously had looked at data sovereignty as simply a regulatory checkbox exercise,” he said, they were now “balancing regulation with perceived risk”.

Sovereignty moves beyond data residency

Almost half – 47 percent – cited cybersecurity as a driver for sovereignty measures, while 26 percent identified potential service disruption caused by global political uncertainty.

Just nine percent prioritised protection against extraterritorial data access, while the same proportion identified reducing concentration risk around overseas providers as a top priority. Meanwhile, 34 percent said AI pressure was forcing action on sovereignty.

Smith argued that organisations need to consider sovereignty as more than the physical location of their data.

Instead, Everpure advocates a move from what it describes as “national sovereignty” towards “corporate sovereignty”, where organisations determine their approach according to the sensitivity of their data, the criticality of individual services and their own tolerance for risk.

“Beyond regulation, it’s about a company understanding its own risk profile and its own tolerance to risk,” said Smith.

That could mean applying stronger sovereign controls to particularly sensitive data or critical services without necessarily requiring every workload to operate within the same environment.

Everpure calls the approach “sovereignty by design”, with datasets, applications and workloads assessed according to their sensitivity, strategic value and legal exposure.

Sovereignty starts to shape procurement

The research also indicates that sovereignty is increasingly influencing tech buying decisions.

Some 80 percent of respondents said they now factor data sovereignty into vendor and RFP decisions, while 85 percent would accept less advanced features and functionality in return for sovereign control. Meanwhile, 86 percent had increased spending on sovereignty during the previous year.

Yet increased spending has not necessarily translated into an ability to deliver.

Smith pointed to the 56 percent of respondents reporting shortages of skills, staff or capacity as evidence of an “interesting mismatch” between investment and execution.

He said sovereignty should therefore move beyond being treated solely as an IT responsibility.

“This isn’t an IT effort,” said Smith. “This involves legal, probably a lot of legal procurement, senior business leaders as well as IT to be able to deliver a holistic strategy for an organisation.”

Everpure recommends that organisations identify their most critical services, applications and data and ensure these can continue to operate in the event of disruption. It also argues that sovereignty requirements should be considered at the beginning of procurement rather than added later.