Data sovereignty is a strategic imperative in the AI era

AI has created a new set of challenges for organisations. From the speed of innovation to the volume and velocity of new vulnerabilities being discovered, there is immense pressure on technology leaders to help the c-suite and boards navigate these volatile waters.

Underpinning every major technology investment is storage. Performance, location and security all play a huge part in ensuring platforms support innovation and security.

Matt Oostveen, the CTO and VP for APJ at Everpure (formerly Pure Storage), says organisations need to think carefully about where their data is housed. Sovereignty is a key issue for decision makers.

"Sovereignty is a combination of the location and ownership of your data. It means that the buck stops with the court of the nation where it is housed and that there is no foreign interference with that data. There's a difference between data locality and data sovereignty."

While this sounds simple in principle, it becomes complex when the ownership structures of cloud providers are considered. While data may be held onshore at local data centres, if the operator of the data centre is foreign owned it could be accessed through court orders issued by other jurisdictions.

"An act like the US Cloud Act enables three-letter acronym organisations from the US to be able, through a supressed court order, to take Australian citizen data even if it's in an availability zone. That's not sovereign," said Oostveen.

This may behind a trend observed by Altay Ayyuce, Everpure's Area Vice President for ANZ. He is seeing data being repatriated away from cloud providers to on-prem and locally owned and operated hyperscalers.

"I've seen an increase of repatriation in play. Partners, our MSP partners especially, are chasing that sovereign dollar out," he said.

This creates a great opportunity for local service providers that are Australian owned. And this is a factor behind Everpure's recent growth in Australia.

Speaking to Everpure's global growth data, Ayyuce said that in its financial year 2027, second quarter results, the company was able to achieve its third quarter in a row where revenue exceeded $1B and 38% year-on-year growth with operating profit growth of 77%. Evergreen//One, the company's platform as a service offering, has also seen broad adoption and contributed to the revenue and profit growth.

"We're at the top five hyperscalers," said Ayyuce. "It's a big indication and validation of our technology leadership and the confidence those big enterprises have in our technology and solutions."

Everpure's research, led by Oostveen, made some interesting findings. With over 2000 respondents from across the world, but excluding North America, the trend towards sovereignty was clearly a major issue. 80% of respondents reported that data sovereignty has become more important during vendor selection over the last year.

"AI has been a great catalyst because there is community concern. As soon as you put AI in there, there are a lot of people that are watching it twice as closely. And rightly so," said Oostveen. "It's a great catalyst, but this is not new. Post-COVID it really started to hockey stick for the last five years."

Another motivation for pursuing sovereignty is that it is a way to protect the domestic IT industry.

"We saw this legislatively a decade ago in some Southeast Asian nations where cloud was leveraging local system integrators and their capability to be successful. New sovereign like laws, although they weren't termed sovereign at the time, put a protection layer around a particular country. DCI Indonesia is a good example," explained Oostveen.

For large organisations operating across multiple jurisdictions, regulation and government policies are both complex and constantly changing. Oostveen said that one CISO, for a major bank, receives daily reports on what is changing across their global network. And while legislation in some locales is quite mature, Oostveen flagged India and the EU as being quite advanced, other countries are still a work in progress.

For organisations making decisions about service providers, the question sometimes comes down to whether they are prepared to sacrifice advanced capabilities offered by global hyperscalers so they can be more assured that their data remains onshore and subject to local laws.

"For years we've had security by design in every small decision we make from a tech acquisition perspective," said Oostveen. "The same is true with sovereignty. You need to bake it in. You can't add it on after the fact. It begins with solid contracts, auditing your suppliers, and understanding where jurisdictional control starts and stops."

AI has accelerated demand for data and regulation continues to evolve. Sovereignty can no longer be treated as a final compliance check. Organisations need to make it a design principle. They must test ownership, jurisdictional laws, contracts and supplier controls alongside performance, cost and capability. Those that understand where their data sits, who can access it and which laws apply will be better placed to innovate without surrendering control.