A security architect is distinguishing data sovereignty from data residency while planning a multi-region public cloud deployment for a regulated client. Which statement best captures data sovereignty?
- AData must simply be stored and processed within a specified geographic boundary chosen by the customer.
- BThe cloud customer, rather than the provider, must hold and manage the encryption keys protecting the data.
- CData is subject to the laws and governance of the country in which it is physically located, regardless of who owns it. Correct
- DData must be replicated across at least two national regions to guarantee availability during an outage.
Why A is wrong: Tempting because it sounds like a location rule, but this describes data residency, which is only about where data physically sits, not which laws govern it.
Why B is wrong: This describes customer-managed key control, a technical safeguard, not the legal concept of which nation's laws apply to the data.
Why C is correct: Correct. Data sovereignty is the principle that data falls under the legal jurisdiction of the nation where it resides, so local law can compel access or restrict transfer.
Why D is wrong: This describes a resilience or availability requirement, which is unrelated to the jurisdictional meaning of sovereignty.