Indigenous Communities Got Data Sovereignty Right. The Cloud Industry Got a Logo.

They were Indigenous communities. And they had the correct definition of data sovereignty before most cloud vendors had a logo.

Here is what they argued, for decades, while the technology industry was busy inventing a different and considerably less useful version of the concept: data sovereignty is not about where data is stored. It is about who controls it. Who decides what gets collected. Who decides what gets shared. Who decides what it is used for. Who has the right to say no.

The enterprise technology industry heard this, considered it carefully, and built a data centre in the right postal code.

Problem solved.

Except, as Indigenous data advocates had been pointing out since before AWS had a Canadian region, it was not solved. It was rebranded. Jurisdiction is not control. A server in your territory is not the same as power over what lives on it. Someone else collecting and controlling data about your people — even from within your own territory, even using your own infrastructure — is not neutrality. It is just power with better signage.

The Māori data sovereignty network in New Zealand built a formal charter around this. The principles are not complicated. Data should reflect the priorities of the people it describes. Governance should involve the people it affects. Infrastructure should serve the community, not extract from it.

Revolutionary stuff. Someone should put it in a white paper.

The rest of us are arriving at the same conclusions now — slightly later, slightly more expensively — after the Snowden revelations, after the CLOUD Act, after watching foreign governments issue nondisclosure-attached data demands to the parent companies of our very local, very compliant, very sovereign cloud providers.

It turns out geography was never the point. Control is the point.

Who owns the platform?

Who holds the keys?

Who can be compelled?

Who can interrupt, inspect, or quietly hand things over with a legal gag order attached and a policy that prevents anyone from telling you it happened?

Indigenous data advocates were asking these questions when the enterprise technology industry was still arguing about whether the cloud was a fad. They did not get keynote slots for it. They did not get credited in the Wikipedia definition of data sovereignty, which still describes the concept as data being governed by the nation where it was generated — as if that sentence has ever stopped anyone from doing anything.

It has not. As several decades of evidence have demonstrated with some enthusiasm.

So here is where we actually landed: Indigenous communities got data sovereignty right. The cloud industry got a logo. And somewhere in between, the rest of us convinced ourselves that a compliance certificate and a local data centre was the same thing as control.

It is not. It never was.

The questions Indigenous data advocates were asking are the same ones that actually matter now. Who controls the infrastructure you depend on? Who holds the levers? Who decides?

If the answer is not you, then what you have is not sovereignty.

It is a very nice-looking dependency.

With a maple leaf on the architecture diagram.

Originally published by Ross Norrie, founder of SkyeConnex, on LinkedIn.

Published March 15, 2026 · More from the SkyeConnex blog