System sovereignty and ArcGIS systems

Sovereignty means being in control of your own decisions and actions, especially in relation to governance, law, and territory. Digital sovereignty refers to the ability of a state, organization, or individual to have control over their own digital infrastructure, data, and technologies, without undue dependence on external entities such as a third party provider or foreign government, ensuring autonomy and security in the digital realm.

Designing a geospatial system that is completely independent of all external entities is a difficult and costly endeavor, but properly assessing risks associated with system sovereignty, how they apply to GIS operations and how organizations can adapt in response to change should be a consideration, especially for mission-critical systems.

For all of the topics on this page, the ArcGIS Trust Center is an essential reference, providing documentation and guidance related to compliance, regional and global legal frameworks, and software options.

Data sovereignty

Data sovereignty is a broad concept with various definitions and components, but generally refers to the concept of storing, managing and accessing data within a certain national border concept or political entity. Data sovereignty requirements are often raised due to laws and regulations of a certain country or jurisdiction, related to the users of a system, the hosting location of the system, or the company that builds and operates a system or software offering. In the context of ArcGIS systems, data sovereignty most often refers to the storage of user data such as login credentials and content along with geospatial data, and attempts to store those data in a way that complies with these regulations. Examples of data sovereignty laws or regulations include:

• Canadian Consumer Privacy Protection Act (CCPPA)
• General Data Protection Regulation (GDPR)
• Australian Privacy Principles (APP)

Data sovereignty requirements are common for businesses that store data in the cloud, so they can ensure that they are able to observe the laws and regulations of the country or jurisdiction. Organizations often respond to these requirements by carefully designing data and storage tiers of their architecture to align to the requirement, with architectural implications that may conflict with access or redundancy goals.

Any strategic approach to data sovereignty also needs to consider more generic data security requirements and patterns such as encryption, access control and monitoring.

Data residency

Data residency is a related topic to data sovereignty, but is more focused in definition – it refers specifically to where a piece of data is stored, usually focused on geographic location, and reflecting a current point in time. Residency usually applies to the physical location of data, which is often in a data center provided by a public cloud provider or a managed services provider, and can sometimes be difficult to clearly establish with the various layers of storage abstraction and redundancy that are offered by many cloud hosting services. Understanding data residency is essential to adhering to data protection regulations, bolstering security, and providing access to data.

Data localization

Data localization refers to an increasingly common requirement that data generated within a country’s borders must be exclusively stored and processed within that same country. While data localization dictates where data must be stored, and data residency indicates its current location, the primary goal of data localization is to control data flow and usage, to safeguard it according to the local laws and standards. This may include ensuring that the users and clients of a certain set of data are only allowed to access it from within a certain country’s boundaries.

Sovereignty in the design process

Discussions related to data sovereignty, localization and residency are all increasingly common, for a variety of reasons:

• In a more networked world, more datasets cross borders each day than ever before. Many organizations and businesses now operate regionally and globally, with users located in different countries and locations, often far from the source systems they engage with.
• Increasing concerns around data privacy and awareness of the importance of personal information protection has raised this issue for individuals, organizations, and government entities that have passed laws generally intended to protect consumers, individuals and national interests.
• Rising geopolitical and economic tensions have raised awareness of inter-reliance on systems and services from other countries. Organizations are carefully examining their existing systems and providing more robust sovereignty requirements in the design of new systems.
• An ever-evolving landscape of cyber-security risk and the risk of data loss or leakage has increased interest in data residency knowledge and management, so that when bad things happen, the impact can be better understood and mitigated more quickly.
• In the world of AI and large language model-based interfaces, the distinction between data residency and data processing has become blurrier – as systems located in various data centers are able to process data, work with services through agentic workflows with or without a human in the loop, and make decisions based on data. All of these reasons bring an increased focus on sovereignty in a system design process.

Approaches and options

A sovereignty strategy for a GIS system can include some or all of these topics:

• Understanding and making intentional decisions related to reliance on local compute and storage providers. This may mean using national or regional cloud service providers or using local data centers.
• Strategies to achieve compliance with applicable local laws, business practices and values.
• Maintaining understanding and control over software, software updates, licensing and data access.

ArcGIS offers a range of software and services options that can be used to balance cost, reliability, accessibility, security and sovereignty, depending on your organization’s needs.

Software-as-a-Service options like ArcGIS Online offer lower cost, greater reliability and can offer useful security patterns, while also offering less digital sovereignty. Regional ArcGIS Online data hosting in geographies like Europe and Southeast Asia provide an option for organizations in those regions.

A system build on ArcGIS Enterprise can take advantage of hosting options such as managed cloud services or can be self-hosted by an organization to offer greater sovereignty control, often with a trade for increased costs and effort.

GIS sovereignty is a requirement that will vary from organization to organization and from region to region. Being aware of it as a requirement and electing to balance it with other resiliency system requirements is foundational to ensuring resiliency.