Digital sovereignty — the claim that states can and should govern data, platforms and infrastructure within their jurisdiction — has moved from doctrine to statute: over 60 per cent of countries now restrict cross-border data flows in some form by OECD and UNCTAD counts, the EU's GDPR adequacy system conditions whole continents' data trade on its judgments of foreign privacy law, China's 2017 Cybersecurity Law and successors built the world's largest data-localization regime, and India, Russia, Indonesia, Vietnam and dozens of others have followed with localization mandates, source-code escrow demands and national cloud procurement rules. The open internet's founding fiction — a borderless commons above sovereignty — is being repealed clause by clause, not by any treaty, but by the accumulating practice of regulators asserting what states have asserted everywhere else: what happens inside our territory is ours to rule.
What are the instruments of digital sovereignty?
Four families. Data-localization laws: mandates that specified data — payments, health, government, sometimes all personal data — be stored in-country, from Russia's 2015 payment-data rule to India's payments-data localization to China's broad regime. Adequacy and conditionality regimes: the EU model, where the European Commission certifies third countries' privacy protection — the adequacy decisions granted to a dozen-plus partners, the invalidation of the US framework in Schrems I and II, the US-EU Data Privacy Framework that succeeded Privacy Shield in 2023 and awaits its own court test. Platform and content rules: the EU's Digital Services Act and Digital Markets Act, Germany's NetzDG, sovereignty debates over algorithmic transparency and jurisdictional takedowns. And infrastructure sovereignty: undersea-cable landing licenses, 5G vendor exclusions — the Huawei bans across the Five Eyes and much of Europe — cloud-sovereign builds like France's SecNumCloud 'trusted cloud' requirements and the EU's sovereign-cloud agenda.
Why did the EU write the rulebook?
Because regulation is the power it has. Lacking the platform companies and the hardware supply chains, Europe built regulatory power: GDPR's extraterritorial reach made the world's privacy officer workforce de facto Brussels compliant, the adequacy system created a diplomacy of data the EU conducts unilaterally, and the DSA/DMA package — with the first DMA designations of gatekeepers in 2023-2024 — extended the pattern to content and competition. The critique writes itself both ways: European digital sovereignty is real power without European digital industry — dependency administered through law — and it is also the world's most successful export of rights-protection standards, copied from Brazil's LGPD to India's DPDP Act. The honest ledger: the EU traded market access for rule-following, and both sides of the trade can be measured in compliance budgets.
Is this fragmentation or federalization?
Both at once, and the direction differs by layer. Fragmentation at the data layer — localization walls, adequacy blocs, the splinternet's censorship variant in the national-intranet model that Iran's and Russia's sovereign-internet laws pursue. Consolidation at the infrastructure layer — the cloud consolidating into three American and a rising Chinese hyperscaler stack, cables and standards bodies becoming arena politics, the technical internet's governance — ICANN, the IETF, standards consortia — holding as the last genuinely multinational layer precisely because sovereignty has not yet learned to legislate protocols. The research vocabulary — data free flow with trust, the Osaka Track's failed universalism, techno-nationalism — marks the contest: a system splitting legally while concentrating physically, which is why the sovereignty debate's sharpest fights are over the physical stuff — chips, clouds, cables — that law cannot relocate.
Who loses in the re-fenced internet?
The measured costs land on the smallest players first. Localization multiplies compliance overhead per market — the economic studies of data-localization's GDP effects, from the European Centre for International Political Economy's estimates to OECD analyses, find measurable trade and productivity losses concentrated in services-intensive small economies; global firms amortize the walls, startups do not. Civil-society and security arguments cut both ways with real force: localization enables surveillance as easily as protection — the same law that keeps health data in-country hands it to the in-country security service — and resilience arguments for sovereign infrastructure collide with the redundancy arguments for distributed storage. The individual user experiences sovereignty as friction: services that geo-block, accounts that cannot migrate, news that stops at the border. None of which discredits the core claim — that populations should govern their digital circumstances — any more than accounting costs discredited the welfare state. It prices it.
What should readers watch?
Three dockets. The adequacy list — each European decision or suspension re-draws the data-trade map a continent at a time. The court calendar — the DSA's and DMA's first major rulings, and the Data Privacy Framework's inevitable Schrems III moment, will set the sovereignty doctrine's case-law. And the infrastructure deals — cloud-sovereign contracts, cable landings, chip-fab subsidies — where the physical internet is being re-nationalized at costs no law reviews. The borderless internet was a thirty-year interlude. What replaces it is being built now, server by server.
For more context, read The Ocean Is the New Contested Frontier — and the Law Is the Map.
For more context, read The Mechanism That Forces a Debate After Every UN Veto.
For more context, read The Shadow Fleet: Sanctions Evasion at Twelve Knots.