The importance of data sovereignty and security creates complexity in a world where sharing such information across borders generates huge social and economic benefits, says Andrew Cruise, Managing Director of Routed, a local VMware Cloud Verified provider and VMware Principal Partner.
It is clear that in the digital age, data sovereignty is becoming more important, as data is increasingly generated and collected through a variety of channels, including e-commerce, social media platforms and mobile devices.
Essentially, data sovereignty is a phrase that describes the principle that a country has the authority and right to govern and control the data generated within its borders. Thus, the concept of data sovereignty gives governments the power to regulate the collection, storage, processing, and distribution of any data that originates within its borders.
Obviously, this will have an impact on cross-border data flows and international data-sharing agreements. Remember that different countries adopt different data sovereignty policies, but broadly they are about demanding that data generated within the country be kept within the borders for security or regulatory purposes.
Complicating the situation is the recognition that data access and the sharing of such information across borders generates social and economic benefits of somewhere between 2.5% and 4% of GDP. In addition, data transfers of this nature also enable a wide variety of other critical activities, such as the sharing of essential information related to crime prevention, scientific research and innovation, anti-fraud and money-laundering activities, disaster management and even climate change.
It’s worth paying close attention to data sovereignty, not only from the point of view of safeguarding private data, but also to avoid liability issues related to legal violations associated with a failure to protect personal information.
A major reason for the complexity around data sovereignty is that the laws governing it vary greatly from country to country, as do cloud service providers’ agreements concerning privacy policies and user rights. Therefore, organisations operating across multiple countries or regions must understand each country’s regulations to comply with all applicable laws.
In fact, ultimately, there are multiple differing definitions of exactly what constitutes ‘data sovereignty’, and it is vital that we obtain some form of industry-wide collaboration in defining and upholding the principles of data sovereignty.
Recognising the complexities of data sovereignty, VMware notes that the answer lies in sovereign cloud deployment, as this is an option that is inherently more secure and offers better data integrity and data assurance.
To this end, VMware is making efforts to promote Sovereign Cloud Partnerships and the criteria they use to select providers, but at the same time, it seeks to limit the number of providers in each region – thus ensuring the rarity of the ‘cloud sovereignty’ badge.
Among VMware’s requirements are for such service providers to have locally sited data centres, and in terms of data security, for them to be ISO and payment card industry data security standard (PCI-DSS) compliant – both areas where Routed has comfortably met requirements.
We already segregate management networks from production networks, storage traffic from a host strategy, and even separate host traffic from public-facing web traffic. In addition, we have multi-factor authentication (MFA) in place and have been leveraging the principle of least access from the very beginning. We are firm believers in the principle that, if you do things properly from day one, you don’t leave any doors open. Thus Routed has been highly conscious of implementing security best practices on its infrastructure from the outset.
Moreover, we understand that while we may have secured our back end as best as we can, poor security measures further down the value chain, like leaving ports open on firewalls, are difficult to mitigate against. However, when it comes to issues of data resilience and data integrity, our business has always had backup and replication products available to assist in a disaster recovery scenario.
Ultimately, there’s no one true definition of what data sovereignty is. But it will always entail data locality within sovereign borders, data security and data integrity. Routed is a South African company born and bred and has always been a local business. Of course, we may do business outside of South Africa, but our data centres are located inside South Africa. We’re not using this as a springboard to scale elsewhere in the world, which enables us to be the best local provider of our services – and data security, integrity and performance are a crucial part of that.
