Data Sovereignty Governance Framework

Abstract

Data has emerged as a central commodity in most modern applications. Unregulated and rampant collection of user and usage data by applications led to concerns on privacy, trust, and ethics. This has resulted in several governments and organizations across geographies to frame laws on data (e.g., the European Union's General Data Protection Regulation (GDPR)) that govern and define boundaries for the storage, processing and transitioning of data; and thereby safeguard the interests of its citizens. Data Sovereignty and Data Localization are two important aspects, which deal with the adherence to the laws and governance structures, that define where and how data is collected and processed. The applicability of different laws depends upon several attributes such as the nature, type, and purpose of data. Non-compliance to laws/regulations can lead to serious repercussions for enterprises, ranging from hefty penalties to loss of brand value. Ensuring that all of their applications are complaint to various laws and regulations is non-trivial. Enterprises have to deal with a plethora of laws (that are constantly evolving) and are often confused even in correctly identifying all the applicable laws for their context leave alone ensuring compliance to regulations. Therefore, in this paper, we propose a knowledge graph based data sovereignty governance framework that assists in classifying data and in identifying the relevant applicable laws.