# Modeling Data Sovereignty in Public Cloud--A Comparison of Existing Solutions
## 1 Introduction  
Data sovereignty within public cloud infrastructure is a complex, multi-layered issue that requires thorough analysis and an understanding of its diverse components. This study builds on a systematic literature review to establish a foundational understanding for developing a data sovereignty model specific to public cloud environments. By examining reference architectures proposed by non-profit organizations, we aim to highlight the state of current frameworks and identify gaps in existing approaches. Additionally, we report on computational experiments designed to test a specific data sovereignty solution in practice. Digital sovereignty, encompassing both data sovereignty and technological sovereignty, refers to the ability of organizations to control their digital assets independently. Data sovereignty, as a component of digital sovereignty, specifically addresses the control an organization maintains over its data, particularly in the context of cross-jurisdictional cloud services. Key drivers include industry-specific regulations, such as the Digital Operational Resilience Act (DORA) for the EU's financial sector, as well as broader international data protection frameworks like the General Data Protection Regulation (GDPR). Beyond regulatory compliance, organizations increasingly recognize the necessity of safeguarding their digital assets to maintain autonomy and security in an interconnected digital landscape. Achieving data sovereignty in public cloud environments requires the implementation of specific sovereignty controls, ranging from contractual obligations to enhanced monitoring of data operations. Although monitoring alone cannot secure data, it can provide accountability by tracking data usage and penalizing misuse. Effective data sovereignty measures are grounded in robust identity and access management (IAM) systems, which enforce sovereignty through secure authentication processes [1]. Cryptographic solutions, such as bring your own encryption (BYOE), also play a crucial role in enabling secure and compliant data handling in public cloud contexts. Several approaches have been proposed to address data sovereignty within public cloud environments. Sovereign cloud offerings from providers such as Atos exemplify solutions that provide varied levels of sovereignty based on customer needs, spanning from privacy-shielding technologies for lower-security requirements to fully isolated cloud instances for sensitive data [2]. Other solutions, such as data spaces [3], enable standardized data ecosystems that facilitate secure data sharing across multiple parties, promoting data sovereignty through controlled access and exchange. Emerging Web 3.0 technologies also show promise, offering decentralized identity management and secure data exchange, which align with data sovereignty objectives [1]. Public cloud providers have developed managed services that extend their cloud platforms to on-premises environments, thereby broadening data sovereignty options. Notable examples include Google Distributed Cloud Edge, Amazon AWS Outposts, and Microsoft Azure Stack, each enabling organizations to integrate public cloud capabilities with their local infrastructure for enhanced control and sovereignty. The systematic literature review conducted for this study reveals a notable gap in the current body of knowledge: existing models are often too closely tied to specific technologies, lacking a generalizable framework that describes the functional layers of data sovereignty applicable across various cloud platforms. To address this gap, we propose an abstract data sovereignty model that organizes the essential layers and functional components independently of technology, making it adaptable for a range of sovereign solutions within public cloud environments or extended to edge computing. Beyond theoretical modeling, we designed and executed computational experiments to validate the practical application of this framework.