Registered agreements
Every sharing agreement is registered with its conditions, participants and timestamps.
DATUM · Sovereignty and control
Sharing is not losing control. Sharing well means governing the external use of data too.
Data sovereignty does not disappear when you share. It is operationalised through formal policies, verified identity and a complete record of every access and agreement.
Sovereignty operationalised
What
You define which asset is shared
With whom
Only verified participants
Evidence
Complete auditable record
Data sovereignty
What data sovereignty means in practice
Sovereignty is not isolation. It is the ability to define, control and audit how your data is used, including outside your organisation.
Owner control
The Data Owner retains control over which asset is shared, with whom and under what conditions, at all times.
Formal conditions
Sharing is not based on implicit trust but on formal agreements with explicit and auditable conditions.
Full visibility
The data owner can see who consumed it, when, for what purpose and for how long.
Revocation capability
Access can be revoked at any time if conditions change or the agreed policy is breached.
Usage policies
What a usage policy is and why it is the central mechanism of sovereignty
A usage policy is not a legal contract in itself. It is the formal, executable expression of the conditions under which an asset may be consumed.
01
Purpose of use
For what the asset may be used. Only for the declared and agreed purposes.
02
Authorised participants
Who can access. Validated identity, verified organisation, declared role.
03
Duration of agreement
For how long the access is valid. With an explicit expiry date.
04
Usage restrictions
What cannot be done with the data: redistribution, re-identification, unauthorised commercial use.
05
Quality conditions
What minimum quality level the publisher guarantees and what happens if it is not met.
Identity and trust
Without verified identity there is no real sovereignty
The identity of participants is the foundation of the trust model. Data is not shared with unverified parties.
Federated identity
Each participant identifies themselves with verifiable credentials in the trust ecosystem, not ad hoc technical credentials.
Established trust
The trust relationship between participants is established formally before any sharing.
Role verification
Not only the organisation's identity is verified but also the declared role and capacity of the consumer.
The principle
Data sovereignty does not disappear.
It is operationalized.
Record and audit
How access and use of shared data is recorded
The evidence record is what turns declared sovereignty into real, auditable sovereignty.
Traced accesses
Every effective access is recorded: who, when, which version and under which policy.
Auditable evidence
The record is auditable by the data owner, the consumer and compliance bodies.
Breach alerts
If an access outside the agreed conditions is detected, the system generates alerts and can revoke access.
Security and compliance
How sovereignty fits with security and regulatory compliance
Data sovereignty is complementary to technical security and regulatory compliance, not an alternative.
GDPR and personal data
Assets with personal data carry specific policies that ensure GDPR compliance in sharing.
Data classification
Only assets with the appropriate security classification for external use may be shared.
Technical segregation
The DATUM core is never exposed. Only the certified and published asset is externally accessible.
Integrated audit
The evidence record is part of the corporate audit model, not a separate system.
Data sovereignty does not disappear; it is operationalised.
Keep exploring
Connect with the next layer
dsg.soberania.related.lead
Next step