What Should a CDO Office Be Doing? Use Data Sovereignty as the Lens.

Most people treat sovereignty like a map problem: keep the data in Canada. But sovereignty is actually a control problem: who can be compelled, who can decrypt, and who can reconstruct something usable.

That’s why a CDO office must be strategic, not tactical. You don’t solve sovereignty with more pipelines.

A strategic CDO should:

• Translate policy into enforceable standards (classification tiers, key custody, audit logging, retention, approved sharing patterns).

• Make sovereignty measurable (single-provider exposure, who holds usable keys, auditability, lineage/provenance).

• Own semantics + interoperability (common definitions, canonical IDs, mapping—so data can actually be combined without constant reconciliation).

• Provide “paved road” patterns (PIA-ready reference architectures, de-identification playbooks, standard data product contracts).

• Curate enterprise data products (a small set of “gold” datasets with ownership, contracts, versioning, quality targets).

• Set AI readiness rules (consent/provenance, bias checks, tiered restrictions, auditable use).

• Sponsor platforms—don’t run jobs (steer catalog/lineage/access governance, but leave pipeline ops to platform/data engineering teams).

Simply: the CDO office should be the constitution, not the construction crew—especially when sovereignty and AI are forcing the enterprise to prove control, not just claim it.

Originally published by Ross Norrie, founder of SkyeConnex, on LinkedIn.

Published March 3, 2026 · More from the SkyeConnex blog