# Modeling Data Sovereignty in Public Cloud--A Comparison of Existing Solutions
## 2 Literature Review  
As a foundation for this study, a systematic literature review was conducted using a query in Web of Science with the keywords \"Data Sovereignty\" AND \"Public Cloud,\" which returned 11 literature items. Additionally, we included a 2023 State-of-the-Art (SoK) paper from the IEEE Symposium on Security and Privacy conference on Data Sovereignty [2] and information from the International Data Spaces Association [3]. References were also expanded based on the reviewer's recommendations: [4; 5; 6; 7; 8]. The literature review reveals three primary perspectives on data sovereignty within the public cloud context: (1) legal aspects, particularly international regulations; (2) strategies for managing public and government data; and (3) technical solutions, ranging from experimental to mature production-ready tools. 1. Legal frameworks and their limitations: The legal dimension of data sovereignty in the public cloud spans various jurisdictions, each with distinct regulatory approaches. Recent studies highlight several challenges: - International regulations and data transfers: Studies focusing on China [9] illustrate regional complexities by comparing overseas data transfer laws in China, the EU, and the USA. However, these frameworks are limited by jurisdictional constraints, creating challenges for multinational organizations that require seamless data access across borders. The lack of global standardization can result in compliance risks and enforcement difficulties. Regional data localization laws: For instance, the EU's ongoing efforts to govern data through projects aimed at cloud federation and standardization [10] underscore regional attempts to manage sovereignty. Yet, these efforts reveal gaps, as they may inadvertently restrict cross-border data flow, complicating data accessibility in globally distributed environments. Similarly, data localization laws in Russia [11] enforce strict national boundaries but face criticism for impeding economic exchange. Historical context of privacy and sovereignty laws: The Data Privacy Matrix (DPM) developed by New Zealand researchers [12] categorizes data privacy laws across major cloud-hosting nations. This resource reflects the inconsistency in data privacy and sovereignty laws globally, which can lead to conflicting legal obligations for cloud service providers and their clients. High-profile events like [PERSON]'s 2013 regulations about the PRISM program have led to increased scrutiny of US-based cloud providers, raising sovereignty concerns for data stored within the USA. The limitations in these legal frameworks demonstrate the need for cohesive, enforceable international standards that address the complexities of data sovereignty. Existing models are insufficient for managing the nuances of data jurisdiction in cloud environments, particularly as they often lack clear provisions for cross-border data governance. 2. Governance frameworks and public data management: Research on governance frameworks reveals various national approaches to managing public and government data in the cloud: Government cloud strategies and sovereignty: In South Africa, studies explore government cloud migration readiness [13]. Challenges arise when attempting to balance sovereignty with efficiency, as on-premises systems are often outdated but shifting to the cloud risks foreign data control. Other studies [14] analyze the government data strategies of the USA, UK, and Australia, where regulations like the USA PATRIOT Act permit extensive access to data by authorities. This raises significant concerns over data control and sovereignty when using foreign cloud providers. Cloud sovereignty projects in the EU: European countries, through initiatives like GAIA-X [15], have launched sovereign cloud projects aimed at creating an ecosystem where data can be securely shared.