UNDERSTANDING DATA SOVEREIGNTY
Data sovereignty is a prominent concept in today’s global data landscape as the ownership and location of data can determine jurisdiction and control. James Mollison says nations like the United States and China are increasingly asserting sovereignty over data based on its location or ownership. He points to platforms like TikTok and Facebook as examples of the power dynamics at play in terms of data ownership aligning with national interests.
Mollison believes data sovereigntyis not just about legal jurisdiction;it’s about protecting individuals and communities from exploitation and harm in an increasingly digitised world.
Concerns raised over privacy, security, and potential misuse of personal information are a challenge for data holders, as users hold them to high standards with safeguarding personal data – whether financial details, health records or online activity – from foreign or domestic threats.
“The citizens of Australia have made it very clear that they expect organisations and government departments to look after their data,” Mollison says. “To protect it, not just from foreign nation states, but from any sort of state affiliated actor, any black hats or subversive elements that could steal that data and use it for nefarious purposes.”
CONSIDERATIONS AND THE CHALLENGES OF IMPLEMENTATION
It’s vital for organisations to consider both the end stage and physical location of their data, including who controls and owns the infrastructure managing it, according to Mollison. This is particularly crucial if data must reside within specific jurisdictions to comply with local privacy laws and governance, like New South Wales with the New South Wales State Records Act.
“You really need someone there who knows where the data fits inside that legislation,” he says. Navigating the legal jurisdiction and understanding the extent of legal authority can be complex, as organisations require diligent supply chain scrutiny to identify who controls data encryption, storage, and access.
“Go through all the data so you can make long-term strategic decisions that are cost effective. You’ve got everyone working together on where this data should be, where it’s mapped to, what that application does.”
This includes assessing risks associated with data storage across different jurisdictions, understanding provider limitations, and making trade- offs in selecting reputable service providers amidst an evolving regulatory and service provider landscape. The service provider ecosystem, marked by new entrants and acquisitions, necessitates close monitoring or reliance on trusted third parties to safeguard against unintended international data transfers.
Internal challenges including cultural, strategic, or commercial factors also impact data sovereignty strategies, since preventing another authority from exerting sovereignty over data requires intelligent strategy. Mollison says AC3 is committed to maintaining its entire application stack onshore to “ensure data cannot be leaked outside of the jurisdiction”, and employs Australian citizens with appropriate security clearances.
FUTURE-PROOFING DATA SOVEREIGNTY AND CLOUD STRUCTURE
Mollison suggests businesses aiming to optimise cloud infrastructure should start by identifying where their data resides, its importance, and its volume. Understanding what data is critical and for how long it will remain relevant can ensure cost-effective protection. Mismanagement, such as underestimating liabilities or failing to classify data properly, leads to inefficiencies and higher costs.
When businesses comprehensively involve service providers in their operations they can benefit from providers making informed decisions about data volume and protection duration. Effective long-term planning and data management enable providers to deliver exceptional outcomes without excessive costs.
Those who overlook the importance of data classification and foresight in planning face unnecessary expenses, especially when urgently integrating additional workloads into a secure environment.
RECOMMENDATIONS FOR BUSINESSES
Act with an eye on the entire sovereignty challenge – ensure new hires are empowered to keep data where it should be and utilise service partners that have unparalleled experience and expertise. Staying ahead of this landscape is tough, and Mollison believes every concerned business “really needs someone who knows what’s going on”.
Entrusting a Managed Service Provider (MSP) that is both privately owned and entirely Australian- based ensures adherence to national standards, regulatory requirements or client demands.
By utilising data management solutions housed within government-accredited data centres throughout Australia, and by deploying products and services from secure Australian enclaves, AC3 guarantees a supply chain that is wholly sovereign and tailored to meet Australia’s specific needs.
“We’ve worked with our partners to be able to deliver fully sovereign infrastructure from the lowest level of the stack right up to the application,” Mollison says. “It is a fast-paced environment. What existed 12 months ago is not what exists today. There is a lot in the public eye, with much higher expectations of the levels companies are expected to hit.”
Many companies struggle to recover from a breach, with their reputations suffering for upwards of seven years as a consequence. Mollison says: “You don’t want your brand, service or your application to be associated with the vulnerability, be associated with loss, so it’s necessary to stay ahead of the evolving regulatory landscape and adapt to technological shifts which together will prevent such associations.”
AC3 boasts significant expertise in this area, particularly with government agencies, in understanding legislation, offering support, providing assistance in governance and tailoring infrastructure to meet specific timelines and goals. “If they’ve got a multi-year plan, that’s fantastic. It enables us to deliver better services with a large amount of capacity, leveraging data centre, hardware and networking providers,” Mollison says.