P1-REQ-13-6-010

Return to Part 1 Requirements

The Conceptual Architecture SHALL distinguish data sovereignty from data residency.

Part 1, Section 13.6: Separation of Concerns Requirements.

Data sovereignty concerns governing authority, legal jurisdiction, policy control, and obligations over information. Data residency concerns the location where information resides. These concerns often interact, but they do not express the same architectural concept.

This requirement prevents location from being treated as authority and prevents authority from being treated as physical or logical placement.

This requirement applies to the concepts of sovereignty and residency within the Conceptual Architecture.

It applies specifically to:

• Data sovereignty
• Data residency
• Governing authority
• Information location
• Release and movement concerns

Verification SHALL confirm that the Conceptual Architecture distinguishes data sovereignty from data residency.

Verification activities include review checks confirming that:

• Data sovereignty references identify authority, jurisdiction, policy control, or obligation concerns
• Data residency references identify information location concerns
• Residency does not substitute for governing authority
• Sovereignty does not substitute for storage or processing location

Related source section:

• 13.6 Separation of Concerns Requirements

Related requirement identifiers:

• P1-REQ-13-5-012
• P1-REQ-13-6-005
• P1-REQ-13-6-011
• P1-REQ-13-6-012

Draft