CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A German hospital wants to migrate patient records to a public cloud but is required by national law to ensure the data remains subject to German legal jurisdiction and is not accessible under foreign government requests. Which concept describes this requirement?
- AData residency
- BData portability
- CData classification
- DData sovereignty
Show answer & explanationAnswer & explanation
Correct answer: D. Data sovereignty
Data sovereignty refers to data being subject to the laws of the country in which it is collected or stored, meaning the hospital must ensure German law—not a foreign jurisdiction—governs the data.
Why the other options are wrong
- A. Data residency refers only to the physical location where data is stored, not the legal jurisdiction.
- B. Data portability refers to the ability to move data between providers or systems.
- C. Data classification refers to categorizing data by sensitivity, not by legal jurisdiction.
Data Sovereignty
The principle that data is subject to the laws and legal jurisdiction of the country in which it is collected or physically stored.
- Distinct from data residency (physical location only)
- Impacts cloud provider and data center selection
- Foreign government access laws (e.g., CLOUD Act) can create sovereignty conflicts
Memory trick: Sovereignty = whose laws Sit over your data