What Does Data Sovereignty Mean for Workplace Technology?

Simon Privett, UK Country Manager, Embrava November 9, 2026 · 10 min read

Workplace Data Sovereignty: what to ask technology vendors. Three working definitions: data residency asks in which country or region the data sits, data localisation asks whether a law requires the data to stay there, and data sovereignty asks whose law applies and who can get to the data.

Data sovereignty is all about understanding which laws and jurisdictions apply to your organisation's data, and ensuring you maintain appropriate control over how that data is managed. This includes how it is accessed, processed, retained, deleted and transferred, and where it is hosted. For workplace technology, that means knowing where your booking, occupancy and device data lives, who can access it, and which legal and regulatory requirements apply. Where the data is physically stored is an important consideration, but only one part of the wider picture.

Consider this: a meeting room panel, desk display or calendar integration. Each can generate or process information about people, spaces and how the workplace is being used. That information may pass through multiple systems, vendor cloud platforms, support teams and third-party subprocessors, potentially across multiple countries. For IT, security and procurement teams, understanding how this data moves through the wider technology ecosystem is becoming increasingly important. This article explores the key considerations around data sovereignty, relevant legal frameworks and the practical questions organisations should be asking when evaluating workplace technology providers.

Sovereignty, residency and localisation: how do they differ?

The three terms get used as if they were interchangeable. They are not, and a contract can satisfy one while leaving another open. These are working definitions, not defined legal terms.

Term	Working definition	The question it answers
Data residency	Where an organisation's data is physically stored or processed, typically determined by the customer's requirements or the vendor's infrastructure.	In which country or region does the data sit?
Data localisation	A legal or regulatory requirement for certain types of data to be stored or processed within a specific country's borders.	Does a law require this data to stay here?
Data sovereignty	Understanding which jurisdictions' laws apply to your organisation's data, and ensuring you maintain appropriate control over how that data is processed, retained, deleted and transferred in accordance with those requirements.	Whose law applies, and who can get to the data?

Data residency is generally easier to define and address within a contract. Data sovereignty is more complex, as a vendor's parent company, its support teams and its subprocessors may operate under different legal jurisdictions, regardless of where the data is stored.

Which laws and frameworks drive the conversation?

Most workplace data sovereignty questions in Europe and the UK trace back to a short list of sources. While other regions have their own regulations, this article focuses primarily on the UK and European perspective.

The GDPR (Regulation (EU) 2016/679) is one of the most significant pieces of legislation governing how organisations collect, process and manage personal data.

Under Article 4(1), personal data includes any information that can identify an individual, either directly or indirectly. Within a workplace environment, something as straightforward as a desk booking linked to an employee's name would fall within this definition.

Article 28 also establishes the responsibilities of third-party providers processing personal data on behalf of an organisation. This includes following the customer's documented instructions, obtaining the necessary authorisation before involving additional data processors, and returning or deleting personal data when the service ends.

Chapter V addresses international data transfers, setting out the conditions under which personal data can be transferred outside the EU. These include transfers to countries recognised by the European Commission as providing adequate data protection, or the use of appropriate safeguards such as Standard Contractual Clauses (SCCs).

Schrems II and the EU-US Data Privacy Framework

International data transfers became a particularly important topic following the Schrems II ruling in July 2020.

The Court of Justice of the European Union invalidated the EU-US Privacy Shield, which had previously provided a framework for transferring personal data between Europe and participating US organisations.

While the ruling upheld the use of Standard Contractual Clauses, it also reinforced the need for organisations to consider whether data transferred overseas would receive a level of protection essentially equivalent to that provided within the EU. This includes considering the laws of the destination country and the potential for government authorities to access that data.

In response, the European Data Protection Board published guidance on additional safeguards that organisations may need to implement when transferring personal data internationally.

A new EU-US Data Privacy Framework was subsequently introduced in July 2023, allowing personal data to be transferred to participating US organisations that meet its requirements.

The framework was challenged in the European courts, but the General Court dismissed that challenge in September 2025. An appeal has since been lodged with the Court of Justice, meaning organisations should continue to monitor developments and verify the framework's status when relying on it.

The UK has its own regime. Under UK GDPR, sending personal data to a separate organisation outside the UK is a restricted transfer, and every restricted transfer must be covered by a transfer mechanism: UK adequacy regulations, appropriate safeguards or an exception. A transfer to a country covered by adequacy regulations is still a restricted transfer, and adequacy is the mechanism that permits it.

Where adequacy regulations do not cover the destination, organisations commonly use appropriate safeguards such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and an exception may apply in limited cases. Since the main transfer provisions of the Data (Use and Access) Act 2025 came into force on 5 February 2026, a transfer that relies on appropriate safeguards must also meet a data protection test: the exporter, acting reasonably and proportionately, must consider that the protection the data receives after the transfer would not be materially lower than the standard of protection under UK data protection law.

The EU Data Act

The EU Data Act (Regulation (EU) 2023/2854), which took effect on 12 September 2025, gives users of connected products, including businesses, greater control over how the data generated by their devices is accessed, used and shared.

It also introduces requirements to make switching between cloud providers easier, reducing vendor lock-in. New design obligations under Article 3(1) apply to connected products and related services placed on the market after 12 September 2026, improving access to the data they generate.

For workplace technology, this reinforces the importance of data accessibility, interoperability and flexibility when selecting technology providers. Whether specific devices or services fall within the Act's scope should be assessed individually.

NIST controls as a shared vocabulary

Widely used by US-based security teams, NIST SP 800-53 Revision 5 provides a framework of security and privacy controls, covering areas such as access management, auditing and accountability.

While not universally mandatory, it provides a useful reference for organisations assessing a technology provider's security practices and requesting supporting evidence.

What data does workplace technology typically collect?

The data collected and processed will vary depending on the technology provider, product and configuration. However, across workplace booking, digital signage and occupancy solutions, there are five common categories:

Calendar Data: Meeting organisers, attendees, booking times, room details and, in some cases, meeting titles.
Presence and Availability: Employee availability, meeting status and associated user accounts.
Bookings and Check-ins: Who has reserved a desk or meeting room, when it was booked and whether the reservation was used.
Device Data: Device identifiers, firmware versions, network connectivity, system logs and operational information.
Identity Data: Names, email addresses, user accounts, directory identifiers and access credentials or badge mappings.

Under GDPR, much of this information may be classified as personal data, particularly where it can be linked to an identifiable individual. For example, combining desk booking records with employee identities could reveal patterns of workplace attendance and movement.

While aggregated or anonymised data may be treated differently, organisations should establish whether individuals can genuinely no longer be identified, rather than assuming that removing names is sufficient.

What should you ask a workplace technology vendor?

When evaluating workplace technology providers, organisations should seek clear, documented answers to the following questions. Wherever possible, these should form part of the procurement and security review process, supported by relevant evidence such as audit reports, certifications or contractual commitments.

1. Data Storage and Processing

In which countries or regions is customer data stored, processed, backed up and accessed?
Can data residency be specified contractually, and how are changes communicated?

2. Subprocessors and Third Parties

Which subprocessors have access to customer data, what services do they provide, and where are they located?
How are customers notified of changes, and can they object to new subprocessors?

3. International Data Transfers

What legal mechanisms support international data transfers, such as adequacy decisions, Standard Contractual Clauses, the IDTA or the Data Privacy Framework?
Where the Data Privacy Framework is used, is the provider's certification active and does it cover the relevant data?

4. Data Retention and Deletion

How long is customer data retained, both during and after the contract?
Does deletion include production systems, backups and logs, and can written confirmation be provided?

5. Encryption and Data Security

How is data encrypted in transit and at rest, and who manages the encryption keys?
Are all data types, including device logs and telemetry, covered by these protections?

6. Access Controls

Which vendor personnel can access customer data, under what circumstances, and with what authorisation?
Does the platform support role-based permissions and Single Sign-On (SSO) for administrators?

7. Auditing and Compliance

What independent security certifications or audit reports are available, and what systems and services do they cover?
Can customers access relevant audit logs and obtain a formal Data Processing Agreement (DPA)?

8. Data Portability and Exit Strategy

What data and configurations can be exported, and in which formats?
How are exports requested, managed and completed?
What happens to customer data and configurations when the contract ends?
Can devices and services continue operating during a migration to another platform?

Frequently asked questions

Data sovereignty refers to an organisation's ability to understand which laws and jurisdictions apply to the data generated by its workplace technology, while maintaining appropriate control over how that data is stored, accessed, processed, retained, transferred and deleted.

No. Data residency refers to where data is physically stored or processed. Data sovereignty is broader, covering the legal jurisdictions that apply and the organisation's ability to maintain control over how its data is managed.

No. The framework only covers US organisations that have actively registered and maintain valid certification. For transfers from the UK, providers must also participate in the UK Extension to the framework.

No. This article provides general guidance for IT, security and procurement professionals. Organisations should consult their legal teams to understand how specific regulations apply to their circumstances.

Talk with an expert

Understanding data sovereignty is an important part of evaluating workplace technology providers.

If you're reviewing your workplace technology strategy or have questions about how Embrava manages data across its ecosystem, we'd be happy to help. Get in touch with the Embrava team to discuss your requirements.

This article is general information, not legal advice.