Data Sovereignty has left the building

Something shifted in the room at our recent Xconnect Data Security event. We brought together a group of CISOs for an honest conversation about data security, and what emerged wasn't a discussion about compliance frameworks or regulatory checklists. It was something far more urgent.

Data sovereignty, a term that has long been shorthand for "where does your data physically sit?", has fundamentally changed. What CISOs are grappling with today isn't jurisdiction, it's control. Can you actually access your data when it matters most? Can you recover it under real-world attack conditions? Those are the questions keeping people up at night, and rightly so.

Ransomware has accelerated this shift more than any regulation ever could. Data is now the primary target. It is more valuable than cash, more disruptive to lose, and far harder to recover. The attackers know this. The question is whether organisations - and their channel partners - have caught up.

The ownership problem nobody talks about

One of the most candid moments of the day came when CISOs openly admitted something the industry rarely acknowledges: nobody is entirely sure who owns data inside their organisation. Is it security? IT? The data team? The business unit that generated it? In most enterprises, the answer is all of them and none of them. Ownership is blurred, accountability is fragmented, and that ambiguity creates exactly the kind of gap that attackers exploit.

This means data sovereignty isn't just a legal or geographic question anymore. It's an internal governance challenge. You can have your data sitting in the right country, with the right contractual protections, and still have no clear line of accountability when something goes wrong. That's a sovereignty failure, even if it never appears on a compliance audit. Data sovereignty isn't a compliance checkbox, it's a business safeguard. When we control where our data sits and who has jurisdiction over it, we protect our customers, our revenue, and our ability to operate with confidence in any market."

Stop selling tools. Start proving outcomes

There was also real frustration in the room about how the market speaks to CISOs. They are not short of tools. Most have more security technology than they can effectively operationalise. What they are short of is confidence. Specifically, confidence that when the worst happens, they can recover.

Backup, it turns out, is not the reassurance it once was. The conversation has moved decisively from protection to proven resilience. CISOs want to see recovery tested, validated, and documented. They want risk quantified in business terms, not technical ones. They want outcomes, not features. Partnership starts with understanding, not a sales pitch. "Solve my problem, and you'll earn my trust."

Where the channel comes in

This is precisely where partners have an extraordinary opportunity, if they're willing to move beyond the product conversation. Data sovereignty, properly understood, is a services-led conversation. Recovery testing, resilience architecture, risk quantification -  these are not things you sell off a datasheet. They require expertise, trust, and a long-term relationship.

The market is moving from compliance to control, and from protection to proven resilience. That transition is uncomfortable for organisations navigating it alone. For channel partners positioned to guide that journey, it represents one of the most significant opportunities in data security right now.

The message from our CISOs was clear. They don't need more tools. They need partners who can prove that when the day comes, the data comes back.