Data sovereignty and privacy regulations are established at various levels, including state, national, and regional, and they significantly impact several key areas:

• Policies regarding data storage retention and access
• Encryption standards for data both in transit and at rest
• The use of data for analytics and AI, particularly for unconventional business purposes
• The formulation of data and AI policies, including the development of "responsible AI" and ethical AI practices

These factors influence data residency and location requirements, dictating where data must be stored and the rules governing data access. Conversely, the location of existing data sets determines the privacy regulations that wealth managers must follow.

Source: Digital Sovereignty: The Impact on Data, AI, and Next-Gen Wealth Management Solutions | Celent

The complexities of privacy, access, and business usage are further heightened by client-specific opt-out clauses and the right to be forgotten. This goes beyond just browser cookies and marketing opt-outs, imposing restrictions on data processing and analytics beyond what is necessary for delivering wealth management services, including:

• Sharing data with other departments within the institution
• Sharing data with third parties, such as fintech companies and government agencies
• Conducting any analytics and AI activities that exceed legitimate business purposes

Additionally, wealth managers now face challenges related to the portability of technology solutions. With the growing reliance on major hyperscaler technology stacks, regulators in both the EU and the US expect wealth managers to address key vendor risks that could affect their operations or the broader wealth management infrastructure. The shift towards more sovereign solutions and stringent data residency requirements complicates architectural portability, forcing wealth managers into a constrained environment of application vendors and cloud providers based on their country of operation.