5 Questions About Data Sovereignty: Answers from BARC & Perforce Delphix

Get Answers to 5 Key Questions About Data Sovereignty

Data sovereignty is no longer a compliance checkbox. As data and AI move into core business processes, organizations need real control over where their data lives, who can access it, and how it powers AI.  

New BARC research shows the stakes rising fast: 51% of organizations now rate data sovereignty as very important, up from 42% last year. In this video, BARC Senior Analyst Timm Grosser answers five questions drawn from the BARC Survey Data Sovereignty 2026: Reality, Relevance, Roadmap. He explains why sovereignty has shifted from a compliance topic to a control topic and how data leaders can turn strategy into data governance that scales across legacy, cloud, and AI environments. 

Learn More About Data Sovereignty & Governance from Perforce Delphix

See how you can simplify meeting data privacy regulations requirements for GDPR, EU AI Act, HIPAA, and more, thanks to Perforce Delphix data masking and governance.

Simplify Data Compliance

Full Transcript

In the past, many companies looked at sovereignty mainly through a legal or compliance lens. The question was: Where is the data stored? Which regulation applies? And are we allowed to use a certain provider? Those questions still matter, but in 2026 the topic is bigger. 

Companies use data and AI much more directly in core business processes. That means the risk is also bigger if data is not under control. The study shows this very clearly. 51% say data sovereignty is very important, up from 42% last year. Overall, 89% say it is very or rather important, and 76% expect the topic to become even more important.

The main reason is simple. Data and AI are becoming operational. They are no longer side projects. They support decisions, processes, customer interaction and innovation. At the same time, companies face more pressure from regulation, cybersecurity, geopolitical developments and dependency on cloud and technology providers. So the change is not only one single event. It is the combination of more AI, more sensitive data, more dependency and more risk.

My short answer would be: sovereignty has moved from a compliance topic to a control topic. First, let me explain the difference between doers and talkers in the study. Doers are organizations that turn data sovereignty into funded action, governance and architecture. Talkers recognize the topic but often remain at the level of strategy, intent or individual projects.

Many companies now say that data sovereignty is strategically important. That is good, but it is not enough. A strategy does not control data by itself. The doers take the next step. They define who owns the topic. They decide which rules apply. They clarify which data can be used, in which system, in which countries, with which providers and for which AI use cases. They fund the work.

The study shows that only 10% of organizations have a dedicated sovereignty budget. But those with a dedicated budget are much more mature in strategic alignment and much more likely to see a positive impact on innovation.

This is important because sovereignty needs coordination. Legal, IT, data, cloud, security and business teams all touch the topic. If nobody owns the end-to-end model, the result is usually fragmented.

The gap in the study shows exactly that. 62% have sovereignty in strategy or in specific initiatives. But only 38% report applied governance. So the difference is very practical. Doers define ownership, decision rights, controls, architecture patterns and funding. Talkers agree that the topic is important, but they do not yet change the way decisions are made or systems are built.

The simple message is: sovereignty only becomes real when it has owners, rules, budget and repeatable implementation patterns. A short answer: welcome to reality.

Companies are now trying to implement sovereignty for real. As long as sovereignty is discussed in a strategy workshop, it looks manageable. But when companies try to put it into systems, the technical complexity becomes visible.

Most organizations have a mixed landscape. They have legacy systems, cloud platforms, data warehouses, data lakes, SaaS applications, local tools and new AI environments. Data moves between all of them.

If you want sovereignty, you need to understand and control those movements. Where does the data come from? Where is it copied? Who can access it? Is it encrypted? Legacy systems are a major bottleneck because many of them were not built for this level of transparency and control. They often hold critical data, but they are hard to integrate, hard to document and hard to govern consistently. And the study shows that technical hurdles increased from 26% to 43%. That is a very strong signal. It means the topic has moved from policy discussion to architecture work.

And this is also why sovereignty is not solved by simply choosing one cloud region or one provider. That may help, but the real challenge is the full data lifecycle across old and new systems. So the hurdles jump because implementation has started. Once companies move from talking about sovereignty to building it, legacy integration and architecture complexity become unavoidable. Learning by doing. Start small, but start with something real.

I would not begin with a large abstract framework. I would pick one important data or AI use case where sovereignty really matters. For example, a use case with sensitive data, cloud services, AI processing or cross-border data flows. Then map the real data flow. Where does the data come from? Where is it copied? Which system processes it? Who has access? What happens in development, testing and production?

This gives you the first useful picture. It shows where control is strong and where it is weak. Then define a small set of non-negotiables, for example access control, encryption, auditability, lineage and exit options. After that, the key is: do not solve the same problem from scratch in every project. Create reusable patterns, approved architectures, standard controls, templates, checklists and clear decision paths.

This is how sovereignty becomes an operating model. It becomes part of how data and AI work is delivered. The study also shows why this is worth doing. Organizations with dedicated sovereignty budgets report stronger strategic alignment and much higher positive impact on innovation. And that is important. Sovereignty does not have to slow innovation down. It reduces uncertainty and makes scaling easier.

So the starting point is: choose one real use case, map the data flow, define the controls and turn the result into reusable patterns. So the difference will be whether companies build sovereignty into the way they run data and AI.

The companies that move ahead will not just write policies. They will create clear ownership, funding programs, practical governance and technical patterns that teams can actually use. They will know which data is sensitive. They will know where it is stored and processed. They will define which workloads can run in the cloud, which need hybrid or on-prem options and where regional providers make sense.

The study shows that many companies are already moving in this direction. 35% are strengthening hybrid cloud and on-prem strategies, 26% are strengthening multi-cloud, and repatriation has doubled from 8% to 16% this year. That does not mean cloud is over. It means companies are becoming more deliberate.

Sovereignty is not anti-cloud. It is about making conscious decisions about where data and workloads belong, which providers to trust and how to reduce dependency when risk becomes too high. The companies that fall behind will treat sovereignty case by case. They will have policies but no operating model. They will have AI ambitions but weak control over the data behind those AI systems. The organizations that scale AI successfully will be the ones that can prove control over the data.