By Zhao Xiaofei, Original
As the Internet evolves, the concept of "data sovereignty" has gradually gained attention from countries worldwide. Given the rapid application of new-generation information technologies, data has swiftly become a critical resource with commercial, social, and strategic value, serving as a crucial variable in international political and economic strategic competition. Countries are extending their focus on cyberspace sovereignty to the data domain, making "data sovereignty" a key international discourse in the digital era. The development of the IoT (Internet of Things) has vastly expanded the scope of data acquisition. In particular, IoT terminal devices are distributed across countries and regions globally, and the management and processing of related data through technologies such as big data and cloud computing have made the issue of data sovereignty increasingly urgent. The development of IoT brings not only changes in technology, engineering, and business models but also significantly challenges traditional data governance models, becoming a key factor for countries to consider when designing data sovereignty systems.
Specificities of Data Governance Brought by IoT Development
Sovereignty is a term in the political and legal domains, but its connotation has been steadily expanding alongside technological advancements. For instance, centuries ago, advancements in shipbuilding and navigation technologies allowed sovereign territories to extend beyond their own land; the development of aerospace technology expanded sovereign territories into airspace and outer space, creating new arenas for sovereign competition. As new-generation information technologies evolve, particularly with the popularization of AI (Artificial Intelligence), big data, cloud computing, and IoT, virtual data has become a new frontier in the competition for sovereignty.
Under the influence of new-generation information technologies, the "borders" of sovereignty are no longer just physical national boundaries or ports; they also encompass a vast number of virtual network connection points. The boundaries of data sovereignty present a multi-layered, intertwined, and dynamically evolving form, making them difficult to clearly demarcate like boundary markers or walls. The criteria for judgment tend toward "substance over form," requiring comprehensive consideration of factors such as the nationality and location of the data recipient, device location, data storage location, legal jurisdiction of the processing entity, employee nationality, and whether the data can be accessed from abroad along with the scope of such permissions. The boundaries of data sovereignty are flexible and subject to continuous adjustment in response to changes in national strategic objectives and technological control capabilities. For example, China's "Guidelines for Declaring Data Export Security Assessments" stipulate that data export refers not only to data being directly transmitted overseas but also includes scenarios where "data collected and generated by data processors is stored domestically, while overseas institutions, organizations, or individuals can query, retrieve, download, or export it." Similarly, the "boundaries" in the EU's GDPR are defined by the location of the data subject (i.e., EU citizens) and the location of data processing activities.
An article titled "The Game of Data Sovereignty and Theoretical Reconstruction," published in the 4th issue of 2025 in the Global Law Review, proposes that the implementation principles of data sovereignty form the foundation for countries exercising data sovereignty and represent the core arena in the global data governance game. It summarizes four principles: the data localization principle, the effects principle, the place of conduct principle, and the data controller principle. Due to differences among countries in data governance objectives, economic interests, and security needs, these principles have sparked widespread disagreements and competition in practical applications, exacerbating the fragmentation of global data governance.
In the context of relevant data sovereignty theories, IoT-based data sovereignty can be defined as the ownership, control, jurisdiction, and compliance management rights over data (including data generation, collection, transmission, storage, processing, and usage) within the IoT environment. Given that IoT data is characterized by massive volume, cross-regional nature, and multiple stakeholders (including devices, platforms, users, and enterprises), the issue of data sovereignty has become extremely complex, involving multiple dimensions such as law, technology, business, and governance.
The specificities of data governance in the IoT environment include:
First, disputes over data ownership. IoT data is generated by terminal devices or sensors, but these terminals involve multiple stakeholders, including device owners, data collectors (platforms), data users (enterprises), and end-users. Currently, there is no unified IoT data ownership model. The industry generally leans toward the principle that data generators (such as device owners or users) own the data, but in practice, this is often constrained by commercial agreements and platform terms.
Second, disputes over jurisdiction and compliance boundaries. This arises because IoT data frequently crosses multiple jurisdictions. For instance, IoT products going global lead to a certain degree of cross-border cloud storage. Data localization regulations and cross-border data flow restrictions in different countries pose challenges to the legal application and jurisdictional definition of data sovereignty.
Third, disputes over cyberspace sovereignty and transmission sovereignty. This aspect is primarily accompanied by the development of physical AI, such as the cross-border movement of connected vehicles and robots. Compliance and sovereignty issues at the network layer during data transmission are becoming increasingly prominent, requiring coordination among network operators and infrastructure in different countries.
Therefore, data sovereignty in the IoT environment faces a series of challenges. These include the evolution of the regulatory environment, where countries are tightening data regulations such as data localization and privacy protection requirements. Enterprises must cope with compliance requirements across different jurisdictions, and implicit cross-border data transmission (such as cloud backups and disaster recovery) is prone to triggering compliance risks. There are also significant risks in cross-border data and data flow, mainly manifested in data flowing among terminals, gateways, and cloud platforms. Cross-regional data backups by cloud service providers and cross-border businesses by third-party service providers make it difficult for some enterprises to accurately grasp the paths of data flow. Additionally, the mechanisms for data value and benefit distribution remain unclear. As a strategic asset, data is subject to different value demands from various participants. The balance between data sharing and privacy protection is hard to strike, easily leading to risks of data abuse and privacy leakage.
Data Sovereignty in Global IoT Deployment
Currently, the number of global IoT connections has reached tens of billions. The globalization and cross-border movement of IoT products are inevitable. Against this backdrop, data sovereignty design is particularly crucial. IoT data sovereignty is a legal compliance issue, but for each specific enterprise, it is more of a core consideration in enterprise IoT architecture design, data governance, and business model reconstruction. A dynamic balance must be sought among technical architecture, business rules, and legal compliance.
The editor-in-chief of the well-known IoT media outlet IoT Business News wrote an article pointing out that enterprises can build system architectures based on data sovereignty, but there is no universal architecture that can meet all regulatory requirements. The more commonly used solutions mainly include:
First, achieve data local retention as much as possible. For example, relying on regionalized cloud deployment solutions, data collected in Europe can be stored in data centers within Europe rather than being automatically transmitted to other regions.
Second, edge-side data processing. Conducting analysis in close proximity to where data is generated allows enterprises to reduce bandwidth requirements and minimize the volume of sensitive data transmitted to centralized cloud platforms.
Third, adopt a federated platform architecture. Some enterprises no longer operate a single global IoT platform but deploy multiple regional instances, exchanging only the data necessary to achieve global visibility.
Fourth, classify data according to sensitivity levels. Not all datasets require the same level of protection. Clarifying which data is subject to regulatory constraints and which is not helps institutions implement appropriate control measures.
Fifth, strengthen encryption mechanisms and access control. Regardless of where the infrastructure is deployed, customer-managed encryption keys, a robust identity management system, and comprehensive audit trails can build an additional layer of security protection.
Notably, many of the aforementioned architectural solutions, in addition to meeting compliance requirements, can also bring operational benefits. For instance, edge processing can reduce latency, regional deployment can enhance disaster recovery capabilities, and clear data governance typically simplifies security management.
However, a major core challenge facing data sovereignty lies in the continuously evolving regulatory environment. A deployment solution that currently meets regulatory requirements may need adjustment in the future, as governments will introduce new data localization rules or tighten restrictions on cross-border data transmission. Enterprises should focus on several aspects: implicit cross-border data triggered by cloud backups, monitoring systems, or disaster recovery processes; the possibility that third-party service providers' own infrastructure or subcontractors may operate in different jurisdictions; the increasingly widespread application of AIoT, which raises numerous issues such as where models are trained, how telemetry data is retained, and whether sensitive operational data flows out of approved regions, all of which require high attention; and government data access requests, whose execution rules vary significantly depending on the headquarters location of the cloud service provider and the data storage location.
As the scale of IoT deployment continues to expand and its layout becomes increasingly globalized, data sovereignty will profoundly influence the design thinking of globalized solutions. If enterprises can proactively address related issues before device deployment and platform expansion, they will be in a more advantageous position in an environment of constantly evolving regulatory rules.