AI
International Data Privacy Day: Why Data Residency and Sovereignty Will Become Even More Important in 2026
And why these matter for your AI and data plans
January 28th marks International Data Privacy Day, a day to raise awareness about the importance of privacy and promote best practices. Privacy has long been about maintaining control of your data, in particular where it goes, and who can see it, and what it’s used for.
Two topics under this theme, data residency and data sovereignty, come up in almost every customer conversation at the moment. While closely aligned, there are key differences.
And when you’re rolling out AI, analytics, and cloud at scale, it’s important to understand the difference. So, let’s slow down and unpack what these mean – in plain language.
First things first: the simple definitions
While these terms are banded around a lot, there are no common definitions. They are seldom used in the laws which underpin them (instead, the laws talk of restrictions on “international data transfers”), so organisations and the market are left to define these themselves. This can lead to confusion. But common understandings, and definitions, are starting to emerge:
Data residency = where your data lives (where’s the hardware)
Data residency is about location.
If you say: “Our production customer data is stored in data centres in Germany”, you’re talking about data residency.
You’re answering questions like:
Which country or region are the servers in
Where are backups held
Data residency is important, from a compliance and latency perspective, but on its own, doesn’t reveal the full picture.
Data sovereignty = data residency + access + other data types beyond what’s hosted in SaaS
In a SaaS context, data sovereignty goes beyond mere residency. It widens data control conversations to also include:
Access (even the ability to access)
As privacy professionals will know, a “transfer” of data to another jurisdiction will happen under law not just when the data physically moves from a hosting perspective, but even if it is accessible (mere ability to access is enough) by persons in another country/region. A “sovereign” solution typically locks down access to only the home country/region.
In today’s world however, with global offices, interconnected systems and complex supply chains, the access picture can become very complicated very fast. It is also constantly shifting as businesses make changes. Achieving data sovereignty is not easy.
Additional Data Types
In a SaaS world, when businesses talk of “sovereign” solutions, they typically mean that their cloud content data (whatever you host “inside” your SaaS solution), plus any data “around it” (think user data, technical support data, etc.) are locked to the home country/region as well. This takes the data conversation beyond what you simply host “in” the SaaS solution.
So, if you say: “Our production customer data is stored in a sovereign cloud solution”, this typically means:
SRE and support staff supporting it are based in your home country/region only; and
the systems that support the SaaS solution (e.g., logs, support files) are also, along with the SaaS tenant and backups, located only in your home country/region.
A picture to keep in your head
Think of a safety deposit box in a bank branch.
Residency = which branch the box is in.
Sovereignty = who (even from abroad) can come and access that box, and who has any data ‘about’ the box.
Why conversations around Data Sovereignty will increase in 2026
As I covered in a previous blog post, regulation drives this conversation. Many laws encourage, but seldom require, absolute data sovereignty. Today, many organisations chose “residency” over “sovereignty” because of the increased business agility that comes with having access to the data from abroad. Data access/processing from abroad can still be compliant by using available legal measures (e.g., contracts like Standard Contractual Clauses, measures like EU-US DPF), as well as technical measures (e.g., encryption with a customer managed key). Many organizations require this complex access web to maintain the agility of their organizations.
For example, in the context of 24/7/365 technical support, if the data/access can’t “follow-the-sun”, then neither can the support service.
So if mere data residency can be compliant, why is there a trend towards more data sovereignty? As well wanting a simplified compliance picture of where their data is, many organisations see it as a way to enhance digital autonomy and resilience. Underpinning much of the desire for data sovereignty too is the desire to reduce any risk of foreign “transfer” so that the data remains subject only to that country’s/region’s laws, and out of scope of any foreign jurisdiction (and any access requests from that foreign jurisdiction).
Your Data, Your Choice
As organisations look to their data to improve their business, in particular how data powers and underpins their AI strategy, these conversations are again on the table. A guiding principle for Qlik in terms of our offerings has always been choice, and for those who wish to have data sovereignty, we want to be a partner with them on that journey.
Looking ahead: Sovereign Cloud with AWS
Expectations are rising, especially for governments and heavily regulated sectors. Some customers need stronger guarantees about where operational control sits and where services are delivered from.
That is why we recently announced that Qlik will be a launch partner for the AWS European Sovereign Cloud (“ESC”).
Qlik’s ESC data and analytics platform will run on infrastructure located in the State of Brandenburg, Germany, designed specifically for EU data residency and operational autonomy. It will be:
Fully featured
Operated independently from existing AWS regions
Backed by strong technical controls, sovereign assurances, and legal protections
Day-to-day operations, technical support, and customer service for Qlik on the AWS European Sovereign Cloud will be handled by Qlik employees residing in the EU.
As with our other regions, customers control access to their data. Neither Qlik nor AWS can access customer data. Customer Managed Keys will also be available in this environment, further reinforcing that control.
What this all adds up to
While regulators continue to refine sovereignty frameworks, customers still have to run their businesses. They need:
Clear choices about where data is stored
Confidence that encryption and access are under their control
Assurance that cloud environments meet regulatory expectations
Qlik provides the technical controls and legal assurances you need to meet your obligations and still move forward, and supports your data sovereignty journey,
Our goal is to give you control, visibility, and choice so you can enforce consistent governance, reduce risk, and make trusted decisions in a world where data sovereignty will only matter more.
In this article:
AI