Data Residency Is Not Data Sovereignty

Data residency describes where data is stored or processed. That can be important for procurement, privacy, security and jurisdictional analysis. But residency does not, by itself, establish who owns the information, who may authorize new uses, which administrators can access it, whether subcontractors are involved, how backups are handled, or whether the organization can export and delete the data on its own terms.

Sovereignty is therefore not a synonym for local hosting. It is the practical and enforceable ability of an organization or Nation to exercise authority over data throughout its lifecycle.

A defensible data decision requires clarity across four dimensions. These dimensions are intentionally simple enough for an executive conversation and broad enough to expose where a platform claim is incomplete.

1. 01Ownership: Who holds the rights, obligations and institutional responsibility attached to the data?
2. 02Decision authority: Who may approve collection, access, sharing, reuse, retention, deletion or a new analytical or AI purpose?
3. 03Access: Which internal users, vendor personnel, administrators, subcontractors or automated systems can reach the data?
4. 04Possession: Who can practically hold, export, restore, delete, withhold or continue operating the data environment?

“Data is stored in Canada” should trigger additional questions, not end them. Leadership still needs to understand administrative access, support arrangements, subcontracting, disaster recovery, encryption-key control, logging, export, deletion, audit rights and proposed secondary uses.

These are not technical curiosities. They determine whether the organization can enforce its own policy, respond to an incident, change vendors, comply with obligations and prevent information from quietly acquiring a purpose that was never approved.

AI systems create new pressure because data may be used not only to complete a transaction but also to generate, classify, infer, retrieve or improve future outputs. The Office of the Privacy Commissioner of Canada emphasizes legal authority or valid consent, transparency, explainability, safeguards, limits on sensitive information and privacy by design.

The executive issue is straightforward: a model or platform should not be allowed to define the organization's data rules by default. Governance must precede—or at minimum govern—the configuration and contract.

First Nations data governance cannot be reduced to a generic corporate policy. The First Nations Information Governance Centre describes OCAP®—ownership, control, access and possession—as an established expression of First Nations data sovereignty and information governance. How those principles are applied remains Nation-specific and should reflect the Nation's own laws, protocols, authorities and priorities.

The responsible posture is not to insert Indigenous language after a platform has been selected. It is to treat Nation-defined control as an operating requirement that shapes the decision from the beginning.

Data governance is strongest before a contract is signed, before migration is complete and before a platform becomes difficult to leave. At those points, the organization still has leverage to define requirements, reject ambiguity and build control into the arrangement.

Residency can be part of that decision. Sovereignty is the larger question: can the organization prove that its authority survives the technology, the vendor and the lifecycle of the data?