The rapid adoption of cloud computing has fundamentally changed how organizations store and manage data. As per the International Data Corporation, the global public cloud services market is projected to reach US$1,806 billion by 2029, up from US$773 billion in 2024.1 Organizations can easily store data in low-cost and flexible cloud environments with these of majorcloud providers, such as Amazon Web Service (AWS), Microsoft Azure, and Google Cloud. However, storing data with global cloud providers can also lead to loss of direct control, as data may be replicated and stored across multiple jurisdictions without customers' knowledge. Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk. Furthermore current challenges, such as increasing tensions between the European Union (EU) and the United States (US) over data transfer agreements, underscore the urgency of addressing these complexities in a rapidly evolving global data landscape.
The Concept of Cloud Data Sovereignty
Organizations looking to implement third-party data management solutions must navigate the associated risk to sensitive data. This raises concerns about data sovereignty, which is the principle that data is governed by the laws of the country where it is stored.2 When considering cloud computing, this concept becomes complex, as data may be stored across multiple international data centers or jurisdictions. Organizations must carefully consider these factors to ensure compliance and protect their data. For instance, in 2020, Microsoft faced challenges when it was ordered by the U.S. government to provide access to data stored in an Irish data center, despite Irish and European Union laws protecting that data under the EU General Data Protection Regulation (GDPR). This case highlighted the issue of conflicting jurisdictional laws and demonstrated the complexity of managing data sovereignty in a global cloud environment.3
Whose Laws Govern the Data?
In a global cloud environment, laws from various countries may simultaneously apply to data.4 For example, European Union citizens’ data will still be subject to the GDPR, even if that data is stored in a US-based cloud.5 However, conflicts arise when countries have contradictory laws. For example, the United States CLOUD Act allows US agencies to demand data from US-based cloud providers, even if that data is stored abroad, while the GDPR restricts data transfers to non-EU countries.6 Which laws prevail depends on individual contracts and negotiations between governments. In addition to the well-established regulations in China, the EU, and the US, other regions are also developing their own data sovereignty frameworks. For example, Brazil's General Personal Data Protection Law (LGPD)7 closely mirrors the GDPR and enforces strict data protection measures. Similarly, Nigeria's Data Protection Regulation, 2019 (NDPR)8 has become a key legal framework in Africa, ensuring compliance for data processing across borders. In the Middle East, countries such as Saudi Arabia and the United Arab Emirates (UAE) are introducing privacy laws to protect data sovereignty in response to growing concerns over cross-border data transfers. These evolving regulations highlight the global shift toward more stringent data governance across diverse legal landscapes.
How Do Regulations Apply?
Organizations must assess data flows to determine applicable regulations. For example, Swiss medical data stored in an AWS Frankfurt data center must still comply with Swiss health privacy laws.9 Organizations using global clouds such as Azure, AWS, or Google Cloud, must have compliance processes that account for all relevant laws, which may require local storage, notify-and-consent requirements, or limiting access to citizen data by foreign entities.10 To manage this complexity, organizations often use compliance tools and automated governance frameworks, such as Microsoft's Compliance Manager11 and the Cloud Security Alliance’s (CSA) Cloud Controls Matrix (CCM),12 to ensure that data handling aligns with various international regulations. These tools facilitate continuous monitoring, automatic reporting, and real-time alerts, ensuring organizations maintain compliance across borders seamlessly.
Who Owns Data Across Borders?
When data moves across borders, ownership questions emerge around who can access, modify, or delete data. For instance, would a US-issued search warrant allow access to an organization's data stored in AWS Ireland?13 Ownership debates also involve intellectual property protections, as trade secret laws vary globally.14 Overall, contracts with cloud providers are integral in determining data ownership rights in cross-border scenarios.
Cloud data sovereignty involves navigating overlaps between data jurisdiction, applicable laws, and localized regulatory compliance. It also involves determining data control rights when using global cloud services that store data across borders.15 This procedure requires coordinating across legal environments and cloud provider agreements.
Governance Challenges of Cross-Border Cloud Storage
Cross-border data flows create complex governance challenges for organizations using global cloud services.16 Key issues include:
Jurisdictional Complexity
In our digital world, most data is stored globally. This means that organizations must contend with contradictory national laws and regulations.17 For instance, China prohibits the transfer of certain data outside mainland China, while the EU's GDPR limits data transfers to countries lacking "adequate" privacy protections”.18 This jurisdictional complexity arises from fundamental conflicts between countries' cybersovereignty interests and creates compliance problems for multinationals.19 Thus, organizations must invest heavily in monitoring regulatory changes across jurisdictions.
Compliance and Audits
Proving compliance with various regulations is difficult without consistent auditing and controls. Frameworks such as the CSA’s Controls Matrix help but ensuring compliant data handling by cloud providers across borders remains challenging.20 For example, in Australia, updates or modifications to the Australian Privacy Act21 require notices for offshore data handling, necessitating adjustments to governance processes.22 Organizations must conduct regular internal and vendor audits to mitigate the risk of noncompliance.
Vendor Lock-In
Although multi-cloud usage mitigates geographic dependencies, transferring large data sets across providers is difficult. Moreover, changing providers does not guarantee that data sovereignty will improve.23 This effectively locks organizations into specific cloud environments. Avoiding lock-in requires portability policies and assessments before cloud commitments.24, 25 This approach allowed Dropbox to retain control over its data, improve operational flexibility, and avoid being solely dependent on a single cloud provider.
Shared Responsibility
Ambiguity around compliance duties adds to governance problems. Cloud providers manage the security of the cloud, while customers remain responsible for security in the cloud.26 However, with data spanning borders, liability for legal violations is unclear. Strong service contracts that delineate compliance obligations are critical. Organizations must invest in governance frameworks to overcome cross-border clouds' inherent jurisdictional, audit, lock-in, and responsibility challenges.
Organizations must adopt a structured approach to address the multifaceted challenges of cloud data sovereignty. One approach is to utilize a three-tiered framework, which categorizes cloud challenges into three key tiers: Legal, Governance, and Technical. The Legal Tier focuses on ensuring global legal compliance and managing jurisdictional conflicts. For example, organizations must navigate laws such as the GDPR, the US CLOUD Act, and local data privacy regulations to mitigate cross-border legal risk. The Governance Tier emphasizes best practices in governance, including auditing and monitoring. Organizations should implement continuous audits, track regulatory changes, and maintain vendor compliance across various jurisdictions. Last, the Technical Tier highlights encryption and cloud infrastructure to safeguard data. Strong encryption, both in transit and at rest, along with robust access controls, reduces the risk of breaches and ensures compliance with data localization laws. This framework helps organizations systematically manage the complexities of data sovereignty in a global cloud environment.
While governance challenges present operational and legal risk, they also impact privacy. Ensuring compliance across multiple jurisdictions inherently involves managing user privacy concerns, particularly as governments introduce more stringent data localization and surveillance laws.
Privacy Concerns with Cross-Border Storage
Storing data across borders creates major privacy risk due to government surveillance and varying legal protections. Key concerns include:
Government Access and Surveillance
Laws allowing domestic surveillance of cloud data enable foreign governments to track data once it crosses borders. For example, the United States CLOUD Act grants US agencies access to any data controlled by US cloud organizations, even when that data is stored abroad.27 However, China's 2017 Intelligence Law requires Chinese companies to share data with the government, including foreign-stored data.28 Mass surveillance capabilities amplify privacy risk when data leaves the country.
User Consent and Control
Transparency is essential for valid user consent on data handling, but cloud complexity obscures where data is stored, processed, and accessed.29 For example, many users do not realize that Microsoft routinely stores EU data in the US.30 Without understanding data flows, users cannot reasonably consent or exert control over their data. This is especially problematic for sensitive medical or financial information.
Data Localization Laws
Many governments enact localization laws requiring that citizen data be stored domestically to limit foreign surveillance. For example, India mandates health data localization to protect patient privacy.31 However, by restricting data flows, localization also fragments the cloud ecosystem. Managing localized data silos adds cost and technology burdens for global providers and users. These laws significantly impact global cloud strategies, as organizations must invest in region-specific data centers and infrastructure to comply with each country's regulations. This increases operational costs, particularly for multinational corporations that rely on global cloud providers. For instance, Amazon and Microsoft have had to build local data centers in China, India, and other countries to meet localization requirements, adding complexity and expense to their global operations.
In summary, cross-border data exposes users to increased privacy risk from government overreach, lack of transparency in data handling, and conflicts between localization laws and cloud connectivity. Navigating these issues requires giving users more control over data flows across borders.
Legal Risk of Cross-Border Storage
Organizations utilizing global cloud services may face legal risk due to jurisdictional conflicts, breach liabilities, and contractual gaps. Key risk areas include:
Conflicting Legal Jurisdictions
With data traversing borders, organizations face contradictory legal obligations. The GDPR bars transfers of EU citizens' data to regions with weaker privacy laws, yet the United States CLOUD Act compels disclosure of data held by US companies to US agencies, even if stored abroad.32 Similar conflicts exist between US surveillance laws and data protection regulations in Asia and Latin America.33 This web of conflict increases legal exposure. Thus, proactive tracking of data regulations across key jurisdictions is essential.
Data Breach Notification and Liability
Data breaches in a multi-country cloud environment trigger complex, overlapping notification duties, as disparate breach notice laws apply based on data location, company HQ, and customer residency. Failure to notify increases fines and liability. A breach affecting EU and US citizens could incur GDPR, The United States Health Insurance Portability and Accountability Act (HIPAA), and state-level US fines simultaneously.34 Close coordination between legal, compliance, and IT teams is key to timely notification.
Cloud Service Contractual Obligations
Current cloud contracts often have jurisdictional gaps that fail to outline accountability for cross-border compliance.35 To manage risk, cloud service level agreements (SLAs) should specify responsibilities and liabilities related to data sovereignty, security safeguards per geography, and legal change management.36 Organizations must negotiate specific terms such as data location, audit rights, and data transfer clauses within these agreements to mitigate legal risk. For instance, organizations should ensure that SLAs define where data will be stored and under what conditions it can be transferred across borders. Additionally, clear audit rights must be established to allow organizations to verify compliance with data protection laws, while data transfer clauses should outline the procedures for legal data transfers under varying regulatory frameworks. Auditing rights and cloud portability options should also be addressed.
In summary, the conflicting jurisdictional claims over data in the cloud create legal minefields for multinational companies. They require significant investment in understanding regulatory divides and reengineering provider contracts to close liability.
Strategies for Mitigating Risk
Organizations can implement various data governance, contractual, and technical controls to reduce the legal, regulatory, and privacy risk of global cloud adoption. These controls include:
Data Mapping and Classification
Cataloging data types, locations, applications, and user access via data mapping provides visibility into flows across borders and supports classification for compliance.37 Classifying by sensitivity and jurisdiction enables selective encryption, localization, and restricted access to high-risk data. Figure 1 illustrates how pseudonymized data can be processed securely across multiple jurisdictions while maintaining compliance with local data sovereignty laws. It demonstrates the flow of data through cloud services such as AWS and Azure, ensuring that the original source data remains protected and controlled by the data owner.
Figure 1—Pseudonymized Data Processing 
Regular audits of data mapping documentation are important for keeping pace with changes in cloud architectures and data flows. To assist organizations in effectively mapping data across borders, figure 2 provides a step-by-step visual representation of how to classify data by jurisdiction and ensure compliance with relevant regulations.
Figure 2—Step-by-Step Guide to Mapping Data Across Borders
Compliance by Design
Building compliance into cloud architectures from the start saves costs over retrofitting governance later.38 Compliance by design means applying jurisdictional data classification schemes to guide where data is stored, mirrored, and accessed based on legal obligations and sovereign risk exposure. Compliance teams should be involved in cloud solution design to identify and address data sovereignty risk.
Vendor Due Diligence
Assessing provider infrastructure, encryption methods, jurisdictional compliance, and assurance testing is crucial for managing outsourced data sovereignty risk.39 Contracts should mandate notification of changes to data handling, storage locations, and new government access requests. To further ensure compliance with cross-border data regulations, organizations can follow a structured process to mitigate risk. There are four steps to implementing data sovereignty measures:
- Data mapping—Identify where the data is stored and in which jurisdiction.
- Jurisdictional compliance—Ensure compliance with local regulations (such as the GDPR in the EU, the LGPD in Brazil, and the NDPR in Nigeria).
- Vendor due diligence—Verify that cloud providers meet local legal requirements and conduct audits on their compliance practices.
- Security controls— Implement encryption and access control based on the sensitivity of the data and the relevant jurisdiction’s regulations.
Ongoing monitoring of vendor security and compliance practices is essential to ensure standards are maintained after contracts are signed.
Encryption and Access Controls
Strong encryption provides technological protection when legal protections fall short.40 Encrypting sensitive data such as healthcare records in transit and at rest reduces surveillance and breach risk. Strict access controls on encrypted data also help enforce data localization requirements. The quality and proper implementation of encryption and access controls should be audited regularly.
In summary, a 3-tier framework offers a structured way for organizations to tackle complex legal, governance, and technical challenges of cross-border cloud storage. By breaking down the issues into distinct categories—legal compliance, governance practices, and technical safeguards—organizations can systematically address data sovereignty concerns, while simultaneously maintaining operational efficiency. Proactive data governance, contractual commitments, and security controls are imperative for companies operating global clouds across fragmented legal environments. Beyond basic governance practices, organizations should adopt robust data localization strategies, ensuring compliance with jurisdictional laws while maintaining operational flexibility. Additionally, organizations must integrate automated compliance tools that continuously monitor changes in data flows and legal frameworks, enabling timely responses to evolving regulations. Strong encryption and access controls are essential to protect sensitive data, but organizations must also prioritize the regular auditing of their data handling practices, ensuring accountability across cloud providers. Furthermore, organizations should negotiate clear SLAs that outline specific responsibilities related to cross-border data handling, audit rights, and data transfer protocols. By establishing comprehensive data classification systems and working closely with legal and compliance teams, organizations can mitigate the risk posed by conflicting international regulations and ensure long-term data sovereignty across global cloud infrastructures.
Conclusion
Overall, as cloud adoption accelerates, organizations will struggle to align data governance with the complex legal and regulatory landscapes surrounding cross-border data flows. Conflicting jurisdictional claims over data, expanded surveillance powers, and fragmentation from localization mandates all intensify compliance risk. Organizations must invest in classifying sensitive data, mapping its movement across borders, ensuring compliant handling in provider contracts, and applying controls such as encryption to help mitigate these challenges. Addressing data sovereignty is crucial for governance in our globally interconnected cloud. Emerging technologies such as artificial intelligence (AI) are beginning to play a critical role in regulatory tracking and compliance, helping organizations stay ahead of changes in legal frameworks. While legal conflicts remain largely unresolved, advances in technical controls and international policy cooperation offer hope for balancing privacy, security, and the economic benefits of data mobility in the future.
Endnotes
1 Statista, “Public Cloud – Worldwide”
2 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance,” Hinrich Foundation, 2021; Lukings, M.; Habibi Lashkari, A.; Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective, Springer Cham, USA, 2022,
3 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance,” ; Lukings, M., Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective
4 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance”; Lukings, M., Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective
5 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective,” Computer Law and Security Review, vol. 38, 2020
6 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective,”
7 IAPP, “Brazilian General Data Protection Law (LGPD, English translation),” October 2020
8 Ajobor, P.; Isiadinso, O.; “Data Privacy Regulations Under the Nigerian Data Protection Regulation 2019,” Mondaq, 7 August 2019
9 Keil, A., Hahn, K., et al.; “Cloud-Based System for Vital Data Recording At Patients’ Homes,” In International Conference on Information Technologies in Biomedicine, p. 15-27, June 2020
10 Keil, A.; “Cloud-Based System for Vital Data Recording At Patients’ Homes”
11 Microsoft Learn, Microsoft Purview Compliance Manager
12 Cloud Security Alliance (CSA), Cloud Controls Matrix (CCM)
13 Keil, A.; “Cloud-Based System for Vital Data Recording At Patients’ Homes”
14 Lukings, M.; Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective; Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”
15 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance”; Lukings, M.; Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective; Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”
16 Ziyi, X.; “International Law Protects the Cross‐Border Transmission of Personal Information Based on Cloud Computing and Big Data,” Mobile Information Systems, vol. 2022, iss. 1
17 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”
18 Lukings, M.; Understanding Cybersecurity Law in Data Sovereignty and Digital Governance: An Overview from a Legal Perspective, Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”; Zheng, G.; “Trilemma and Tripartition: The Regulatory Paradigms of Cross-Border Personal Data Transfer in the EU, the US and China,” Computer Law and Security Review, vol.43, 2021
19 Vatanparast, R.; “Data Governance and the Elasticity of Sovereignty,” Brooklyn Journal of International Law, 2020-2021
20 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”
21 Office of the Australian Information Commissioner, “The Privacy Act”
22 Mitchell, A. D.; Samlidis, T.; “Cloud Services and Government Digital Sovereignty in Australia and Beyond,” International Journal of Law and Information Technology, vol.29, iss.4, 2021, p. 1606
23 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance”
24 Aaronson, S. A.; “Data is Disruptive: How Data Sovereignty is Challenging Data Governance”; Ziyi, X.; “International Law Protects the Cross‐Border Transmission of Personal Information Based on Cloud Computing and Big Data”
25 Kidd, C.; “How Dropbox Reduced OpEx by Moving to a Multi-Cloud,” BMC Blogs, 21 September 2018
26 Zheng, G.; “Trilemma and Tripartition: The Regulatory Paradigms of Cross-Border Personal Data Transfer in the EU, the US and China”; Mitchell, A. D.; Samlidis, T.; “Cloud Services and Government Digital Sovereignty in Australia and Beyond”
27 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”; Kushwaha, N.; “Up in the Air: Ensuring Government Data Sovereignty in the Cloud”
28 Abraha, H. H.; “Law Enforcement Access to Electronic Evidence Across Borders: Mapping Policy Approaches and Emerging Reform Initiatives,” International Journal of Law and Information Technology, vol. 29, iss. 2, 2021, p.118-153
29 Guamán, D. S.; Del Alamo, J. M.; et al.; “GDPR Compliance Assessment for Cross-Border Personal Data Transfers in Android Apps,” IEEE Access, vol. 9, 2021, p. 15961-15982
30 Guamán, D. S.; Del Alamo, J. M.; et al.; “GDPR Compliance Assessment for Cross-Border Personal Data Transfers in Android Apps”
31 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”; Kushwaha, N.; “Up in the Air: Ensuring Government Data Sovereignty in the Cloud”
32 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”; Kushwaha, N.; “Up in the Air: Ensuring Government Data Sovereignty in the Cloud”
33 Rojszczak, M.; “CLOUD Act Agreements From an EU Perspective”; Kushwaha, N.; “Up in the Air: Ensuring Government Data Sovereignty in the Cloud”
34 Van den Heuvel, K.; van Hoboken, J.; “The Justiciability of Data Privacy Issues in Europe and the US,” Research Handbook on Privacy and Data Protection Law, Edward Elgar Publishing, p. 73-108, UK, 2022,
35 Van den Heuvel, K.; van Hoboken, J.; “The Justiciability of Data Privacy Issues in Europe and the US”
36 Van den Heuvel, K.; van Hoboken, J.; “The Justiciability of Data Privacy Issues in Europe and the US”
37 Belli, L.; Gaspar, W. B.; et al.; “Data Sovereignty and Data Transfers as Fundamental Elements of Digital Transformation: Lessons From the BRICS Countries,” Computer Law and Security Review, vol 54, 2024
38 Tang, M.; “The Challenge of the Cloud: Between Transnational Capitalism and Data Sovereignty,” The Geopolitics of Chinese Internets, p. 63-77, Routledge, USA, 2024
39 McGillivray, K.; Government Cloud Procurement, Cambridge University Press, UK, 2021
40 Ziyi, X.; “International Law Protects the Cross‐Border Transmission of Personal Information Based on Cloud Computing and Big Data”; McGillivray, K.; Government Cloud Procurement
Alex Mathew, Ph.D., CISSP
Is an associate professor in the Department of Cybersecurity at Bethany College (West Virginia, USA) and is widely recognized for his deep expertise in cybersecurity, cybercrime investigations, next-generation networks, data science, and IoT Azure solutions. His proficiency in security best practices, particularly in IoT, cloud systems, and healthcare IoT, is complemented by his comprehensive knowledge of industry standards such as ISO 17799, ISO 31000, ISO/IEC 27001/2, and HIPAA regulations.
As a certified Information systems security professional (CISSP), Mathew’s leadership is evident in his role as a consultant across international regions, including India, Asia, Cyprus, and the Middle East. His extensive two-decade career, distinguished by numerous certifications and over 100 scholarly publications, underscores his commitment to advancing the field. Mathew has been a pivotal force in organizing cybersecurity conferences and establishing incubation centers, contributing significantly to the academic and professional community.
A highly sought-after speaker, Mathew’s influence extends to international conferences where he shares his insights on cybersecurity, technology, and data science. His remarkable interpersonal skills and openness enhanced his ability to engage and inspire diverse audiences, further cementing his position as a leader in his field.
