The servers are inside the country. The administrator account belongs to a supplier abroad. Nobody in the ministry can deploy a release without them.
Calling that digital sovereignty is doing quite a lot of work with a postcode.
The short answer: digital sovereignty is the practical ability to make and enforce decisions about digital systems, data and their operation. Local hosting may help meet a requirement, but it does not by itself provide control. Test what the institution can do when a supplier stops cooperating.
Separate location from control
Data residency describes where data is stored or processed. Sovereignty is a wider question about authority and capability. A locally hosted service can still depend on proprietary interfaces, externally controlled keys or skills available from only one supplier.
Conversely, access to source code does not guarantee that a government can operate a system. Someone must understand the build, integrations, security model and release process. The useful conversation joins rights with operational ability.
The Open Source Definition establishes software freedoms, including redistribution and modification. It does not certify a deployment’s security, governance or institutional independence.
Use a control map
| Layer | Ask this | Ask for this evidence |
|---|---|---|
| Data | Can we obtain complete, usable records? | An export and independent import test |
| Identity | Who can grant or revoke privileged access? | Client-controlled administration and access review |
| Keys | Who controls encryption and recovery? | Documented custody and tested recovery |
| Software | Can another team build and modify it? | Reproducible build and dependency records |
| Operations | Can we restore service without the incumbent? | Client-led restoration exercise |
| Suppliers | Can we substitute one provider? | Interface documentation and transition plan |
| Capability | Who maintains these abilities? | Named team, funded roles and training |
The rows are deliberately practical. A policy asserting ownership is weaker evidence than a successful exercise demonstrating it.
Run the supplier-exit exercise before you need it
Choose a non-production environment and ask a second competent team to restore a service from the materials you actually hold. Give them the documentation, backups, configuration and agreed access. Observe where the exercise stalls.
Missing credentials are one kind of dependency. An undocumented transformation hidden in an integration script is another. A licence restriction that prevents the intended replacement arrangement is a third. Record each separately because the remedy is different.
Do not demand an immediate switch simply to prove a political point. The exercise is there to expose dependence and price its reduction. Some dependencies may be acceptable if they are understood and governed.
Open source helps, but someone still has to own the job
Open-source software can preserve the ability to inspect, modify and redistribute under its licence. Those rights are valuable in long-lived public systems. They become more useful when procurement also secures documentation, skills transfer and maintainable customisations.
A heavily customised fork with no upgrade plan may create a new dependency on the team that built it. Ask which changes should be contributed upstream, how security fixes reach the deployment and who pays for ongoing maintenance.
For the broader distinction between shared infrastructure and individual products, see what digital public infrastructure means. A sovereignty assessment should cover the whole operating arrangement, not simply award points to a software category.
Make the trade-offs explicit
A government may prioritise resilience, legal control, local capability, cost or rapid service improvement. These aims can conflict. Document the trade-off and the authority accepting it instead of claiming that a single architecture solves all of them.
For UK or UAE public-sector work, identify the actual institution, data classification, procurement obligations and applicable legal requirements. Do not transfer a generic hosting rule from one jurisdiction to another. This worksheet supports the technical and operational discussion; the relevant specialists must determine the obligations.
What should be funded next?
Start with the gap that threatens continuity or prevents a credible exit. That could be an export tool, a tested recovery process, additional maintainers or clearer rights in a supplier agreement.
Sovereignty requires a budget for capability, not just a preference for a location. A smaller system your institution can operate may provide more control than a grand platform nobody can change.
Sources and scope
Reviewed 1 November 2026. The examples and worksheets are my suggested working methods, not measured client results or official standards.
