For more than two decades, the architecture of the digital economy rested on the premise of borderless data. With the corporate cloud fracturing along the fault lines of state sovereignty and geopolitical rivalry, that premise is dissolving. Crucially, public discourse frequently conflates two distinct regulatory forces: privacy protection and data protectionism. What is frequently framed as a progressive victory for individual data privacy is, in practical application, a systematic repurposing of privacy frameworks into instruments of defensive statecraft
The rise of fortified data territories
Policymakers are systematically deploying cross-border data transfer restrictions, strict security assessments, and explicit localisation mandates to force the physical enclosure of digital assets. Empirical tracking by the Information Technology and Innovation Foundation (ITIF) underscores the velocity of this shift, showing that the number of countries enforcing data localisation policies expanded from 35 in 2017 to 62 in 2021. By 2026, tracking by the United Nations Conference on Trade and Development (UNCTAD) identified more than 147 nations operating active or pending data localisation requirements. In this emerging landscape, national security imperatives and domestic industrial policy routinely supersede technical efficiency.
The mechanisms deployed to fragment this global infrastructure represent a structured continuum of regulatory efforts. These measures range from conditional cross-border transfer regimes like the EU GDPR's Standard Contractual Clauses to absolute transfer prohibitions, such as Australia's restriction on storing electronic health records outside of the country. Where privacy laws once dictated how information is processed, this new instrumentalization of privacy frameworks for defensive statecraft dictates where hardware must be located.
Compulsory capital extraction
To understand why data localisation has emerged as a key pillar of contemporary statecraft, one must examine the deep structural asymmetries of the global technology economy. The international digital ecosystem is dominated by a technological duopoly: the United States and China. The information and communications technology investment gap between American and European companies stands at approximately $1.36trn. Driven by this structural imbalance, American hyperscalers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud collectively account for over 70% of the European Infrastructure as a Service (IaaS) market, while regional European cloud providers claim less than 10%.
The economic toll of behavioural hedging
For multinational corporations operating across these fragmented legal environments, the demise of unified global cloud architectures imposes severe operational friction and escalating overhead costs. Global enterprise IT design historically relied on standardised software deployments and global data lakes. Regulatory fragmentation breaks these economies of scale, forcing companies to adopt complex strategies of corporate behavioural hedging.
To remain compliant across conflicting regulatory jurisdictions, multinational enterprises must partition their IT infrastructure into isolated regional silos. A multinational firm can no longer run unified predictive maintenance algorithms or global supply-chain analytics across a single global repository. Instead, it must deploy duplicate application stacks, establish isolated database instances, and maintain localised compliance teams in every major jurisdiction in which it operates.
The macroeconomic impact of this forced operational fragmentation is substantial. Econometric modelling by ITIF, utilising the OECD’s product market regulation database, demonstrates that a single-point increase in a country’s data restrictiveness index results, over a five-year period, in a 7% reduction in gross traded output, a 2.9% drag on productivity growth, and a 1.5% inflationary increase in downstream prices.
The economic impact does not stop there. Empirical analysis by the Information Technology and Innovation Foundation (ITIF) reveals that uncoupling infrastructure from central regional hubs forces enterprises to absorb severe premiums. In the European Union and South America, mandatory data residency increases localised cloud service costs by 10.5-54%. This steep premium is driven by real-world physical friction: the capital expense of localized real estate acquisition in high-tariff jurisdictions, hardware redundancy born from deploying local server arrays, and the ongoing fixed corporate overhead of fielding independent regional security operations centers and compliance teams.
These structural inefficiencies create operational challenges for heavily integrated global industries. The automotive and advanced manufacturing sectors are exposed to severe regulatory risks under rules like China's February 2026 automotive data provisions, effectively halting cross-border R&D collaboration. Financial services face similar hurdles under Article 30 of the European Union’s Digital Operational Resilience Act (DORA), which mandates that all third-party ICT contracts explicitly specify the exact geographical regions where data is processed and stored.
The rapid growth of enterprise generative artificial intelligence has further intensified these localisation pressures. As transferring proprietary context data across borders risks severe regulatory penalties, which under the EU AI Act can reach €30m or 6% of global annual turnover, multinational corporations are forced to deploy localised AI models hosted within sovereign cloud environments.
This dynamic is driving a massive expansion in the sovereign infrastructure market, with enterprise spending on sovereign cloud IaaS projected to increase from $37bn in 2023 to $169bn by 2028—a 36% compound annual growth rate that outpaces the general public cloud market. To manage these legal and technical complexities, enterprise IT architectures are shifting toward hybrid cloud models, pushing European enterprise hybrid cloud spending to $41.4bn. While this approach helps enterprises mitigate immediate regulatory risk, it permanently increases IT operational costs and dismantles the scale efficiencies that defined twentieth-century globalisation.
