Nearly nine in ten senior executives believe a data sovereignty failure could cost them their jobs. Yet almost two thirds of their organisations have no formal sovereignty strategy, new global research shows.
The Global Data Sovereignty Report 2026 was commissioned by Everpure, the storage and data management company formerly known as Pure Storage.
Research firm Vanson Bourne surveyed 2,100 C-suite and IT leaders from large enterprises in June 2026. Respondents came from eight countries: Australia, the UK, France, Germany, Japan, South Korea, Singapore and India.
Of those surveyed, 88% said a sovereignty failure could cost them their jobs, and 91% were worried about financial and reputational damage to their organisation. Overall, 90% recognised data sovereignty as a business concern.
Despite this, 64% of organisations operate without a formal data sovereignty strategy. The report calls the difference between executive recognition of risk and operational readiness a "sovereignty gap".
Visibility is a core weakness. Some 62% of organisations lack full visibility into who can access, control and manage their data.
More than half, 56%, have no mitigation plans for geopolitical data exfiltration or service disruption. The same proportion admit they lack the skills and capacity to deliver sovereignty initiatives, and 36% face challenges with executive buy-in.
Australia lags on procurement
Only 9% cite protection against foreign government data requests as a top priority.
The report shows wide regional differences in how sovereignty shapes buying decisions. In India, 44% of organisations treat sovereignty as a significant consideration in vendor selection and RFP processes, while in Australia the figure is 16%.
Skills shortages are a common thread. The report quotes a senior manager at an Australian insurer with more than 5,000 employees: "We face a shortage of skilled professionals with expertise in both data sovereignty regulations and technical implementation."
Many organisations are already changing how they buy. Some 85% said they would sacrifice advanced features and functionality to partner with a sovereign cloud provider.
Another 40% are actively limiting their use of SaaS platforms that rely on non-domestic hosting. And 86% have increased their sovereignty investments in the past six to 12 months.
Looking ahead, 92% expect local or sovereign clouds to become the default deployment model for sensitive workloads within three years. And 87% will prioritise local or sovereign environments for high-risk or sensitive AI workloads over the next one to three years.
Focused on the wrong risks
"Senior leaders understand their jobs are on the line over data sovereignty, yet many are still focused on the wrong risks," said Alex McMullan, Chief Technology Officer, International, at Everpure.
"Sovereignty is not simply about where data is stored, but having full visibility and control over it through modern data management."
Rahiel Nasir, Research Director for Worldwide Digital Sovereignty at IDC, said digital sovereignty had moved from a compliance conversation to a critical board-level concern.
"The challenge for executives is not just about knowing where their data are hosted. It is about being in total control of all data access and transfers (including all metadata), guaranteed protection against extra-territorial data requests, and managing IT and vendor risks in light of geopolitical uncertainties," he said.
Sovereign by design
Everpure recommends what it calls a "sovereign by design" approach. Sovereignty controls and governance are applied according to the risk of each data set, application and workload.
The focus shifts from national sovereignty to corporate sovereignty, based on an organisation's own risk appetite and view of regulation. Everpure argues this lets businesses protect critical assets without giving up global SaaS and cloud services.
On the same day, the company announced updates to Everpure Data Intelligence. The product discovers, classifies and adds context to data across Everpure's platform, public clouds, SaaS applications and third-party storage.
A new privacy-first file intelligence capability shows who can access each file share and how stale it is, without reading file content. Everpure says this lets teams fix exposure and reclaim capacity before opening shares to AI agents.
Native support for the Model Context Protocol (MCP) allows AI agents and security tools to query live data catalogues in natural language. Agents can find relevant data and see its sensitivity classification as an input to AI workflows and analytics.
Deployment now runs through the existing Pure1 console, without separate management servers or professional services engagements.