Data Sovereignty and Digital Borders

Data sovereignty refers to the principle that data is subject to the laws of the country in which it is collected or stored, and "data localization" laws requiring that data physically reside within national borders have become one of the primary tools states use to assert control over the digital economy. The European Union's General Data Protection Regulation (GDPR, formally Regulation (EU) 2016/679), which took effect on 25 May 2018, does not mandate localization outright but tightly restricts transfers of personal data outside the European Economic Area absent an adequacy decision or approved safeguards. The Court of Justice of the European Union's Schrems II ruling (Case C-311/18, decided 16 July 2020) invalidated the EU-US Privacy Shield framework that had governed such transfers, forcing companies to rely on Standard Contractual Clauses and eventually prompting the negotiation of a successor EU-US Data Privacy Framework, adopted by the European Commission in July 2023.