Data Sovereignty and Enterprise Data Management: Extending Beyond the European Union General Data Protection Regulation

Data sovereignty refers to privacy legislation governing information that is subject to the laws of the country where the information is located or stored. Data sovereignty impacts the protection of data and is affected by governmental regulations for data privacy, data storage, data processing, and data transfer across international borders.

The European Union’s General Data Protection Regulation is a recent example of a data sovereignty law. Other examples include Australia’s Privacy Act, Canada’s Anti-Spam Law, the People’s Republic of China’s Cybersecurity Law, and Russia’s Personal Data Localization law.

Data sovereignty laws are emerging as a key impediment to cloud-based storage of data. These laws also have an impact when information is created in one country but then is moved to another country for storage, analytics, or processing. Data sovereignty is thus becoming increasingly important to multinationals with business operations, customers, and employees in several countries. It is crucial for organizations to be able to accurately identify who has control and access to their data—wherever it is located.

As with all enacted regulations, compliance requires a sound data governance program with effective enterprise data management. Data governance is the formulation of policy to optimize, secure, and leverage information as an enterprise asset by aligning the objectives of multiple functions. Enterprise data management refers to an organization’s ability to precisely define, easily integrate, and effectively retrieve data for both internal applications and external communication.

This book, geared toward business users, outlines 16 core steps to operationalize a data governance program geared to data sovereignty compliance. Successful data sovereignty requires collaboration across the organization, including among those responsible for legal, risk, compliance, information technology, and enterprise data management. The amalgamation of skills and technology within the organization will support the operationalization.

As organizations extend the reach of their operations and customer base and look to leverage the cloud for computing, data distribution, and application hosting, they must understand the ramifications their business and IT decisions could have with respect to data sovereignty laws. With the concepts outlined in this book, organizations will be equipped to move forward to address the challenges of data sovereignty.

Sunil Soares is the founder and managing partner of Information Asset, a consulting firm specializing in helping organizations build out their data governance programs. Prior to this role, Sunil was director of information governance at IBM, where he worked with clients across six continents and multiple industries. Before joining IBM, Sunil consulted with major financial institutions at the Financial Services Strategy Consulting Practice of Booz Allen & Hamilton in New York. He is the author of eight books on data governance topics.

Mark Gallman is a principal consultant with Information Asset. He is experienced in working with clients to develop and operationalize tailored information governance programs for a variety of industries. He collaborates with cross-functional stakeholders at all levels of the organization in developing best practices, standards, and methodologies to assist in the execution, implementation, and sustainability of governance to support strategic core initiatives. Mark previously was a director of financial systems and data governance at CDK Global, a division of a Fortune 500 company, specializing in integrated technology and digital marketing solutions to the automotive retail industry and adjacencies. Partnering closely with leaders, Mark developed and directed the strategy for formalized data governance, master data management, and data quality for the organization. Mark has more than 20 years of global experience with large multinational software, manufacturing, and services companies.

Pamela Basil is a manager consultant with Information Asset. Previously, she was vice president of data governance and quality in the chief data office at TD Bank, where she successfully developed and implemented a training program to train more than 350 data stewards, subject matter experts, and data managers. Pam drove data governance maturity within lines of business across TD Bank and was a key presenter during regulatory examinations of the chief data office. In a prior role, Pam was supervisor and chief data steward for Independence Blue Cross, a health care payer. Here, she provided leadership and direction to 21 data stewards across the enterprise who managed independent data domains. She led and facilitated enterprise data councils to drive the maturity for corporate reference data. Pam is a member of DAMA International and vice president of membership on the DAMA Philadelphia board of directors.