The infrastructure trap: why data sovereignty mandates make small economies poorer

A curious pattern has emerged across smaller economies in the past few years. Governments from Southeast Asia to Eastern Europe to sub-Saharan Africa have introduced or expanded requirements that certain categories of data must be stored within national borders. The stated aim is sovereignty: to ensure that citizen information remains under domestic jurisdiction and beyond the reach of foreign intelligence services or corporate overreach. The practical effect has been rather different.

These data localisation mandates compel both domestic firms and foreign operators to build or lease server infrastructure within the implementing country. For large economies with established technology sectors, this represents an inconvenience and a compliance cost. For smaller jurisdictions with limited technical capacity, it creates a structural trap. The countries that can least afford to build and maintain modern data infrastructure are precisely those being forced to do so by their own legislation.

The economics are unforgiving. Hyperscale data centres achieve their efficiency through enormous scale, distributing fixed costs across vast user bases and optimising for utilisation rates that approach theoretical maximums. A data centre serving a country of five million people cannot achieve anything like these efficiencies. Power costs per unit of computation remain higher. Cooling systems run less efficiently. Redundancy and backup systems represent a larger share of total capacity. Skilled personnel command salaries at or near international rates whilst serving a fraction of the user base.

The result is that businesses operating in these jurisdictions face data storage and processing costs that can be several times higher than they would pay for equivalent services from global providers operating at scale. These costs do not remain abstract. They flow through to consumer prices, reduce the viability of data-intensive services, and create a structural disadvantage for any firm attempting to compete internationally whilst maintaining a base in a localisation jurisdiction.

The sovereignty promised by these mandates proves equally illusory. Physical location of servers does not determine who controls the data or the infrastructure. In most smaller economies, the local data centres are built and operated by the same multinational firms that would have hosted the data abroad. The servers sit within the border, but the management systems, security protocols, and ultimate technical control often remain with foreign entities. A government that lacks the expertise to audit complex cloud architectures or negotiate detailed service agreements gains little meaningful authority by insisting the hardware be domestic.

The asymmetry of expertise matters more than the asymmetry of physical assets. When a government negotiates with a major cloud provider or telecommunications firm, the technical complexity of modern infrastructure creates profound information disadvantages. Officials may specify that data remain local but lack the capacity to verify compliance, audit data flows, or detect when information is replicated or processed across borders. The appearance of control substitutes for its substance.

Where genuine leverage exists, it lies not in localisation but in standards-setting and interoperability requirements. A regulation that mandates open data formats, requires interoperability between platforms, or establishes clear liability frameworks for data breaches can shift power without requiring expensive infrastructure duplication. These approaches demand different expertise: not the ability to build data centres, but the capacity to write technically precise regulations and enforce them through sustained institutional attention.

Yet standards-setting and interoperability negotiations require exactly the kind of deep technical and legal expertise that smaller jurisdictions typically lack. It is far simpler politically to mandate localisation, which offers the appearance of decisive action and appeals to nationalist sentiment, than to build the regulatory capacity for complex ongoing engagement with global technology firms. The result is that countries pursue the policies they have the capacity to announce rather than those they have the capacity to enforce.

The trade-offs might be defensible if localisation mandates delivered clear security or privacy benefits. The evidence remains equivocal at best. Data breaches and unauthorised access occur with similar frequency in localised and non-localised environments. The threat model that localisation addresses—foreign government access to data stored abroad—represents only one vector among many. Malicious actors care little whether they are compromising servers in Dublin or Dhaka. Meanwhile, the concentration of data in smaller, less sophisticated facilities may actually increase vulnerability.

There are contexts in which localisation serves legitimate ends. Jurisdictions with substantial technical capacity and clear security requirements may reasonably conclude that the costs are justified. The calculation differs for a country with advanced technology sectors and credible domestic alternatives to global platforms. But these are not the countries driving the current wave of localisation mandates.

The pattern instead is one of policy diffusion without regard to local capacity. A handful of large economies implement localisation requirements, and smaller jurisdictions adopt similar frameworks without the infrastructure or expertise to make them effective. The result is a growing patchwork of regulations that fragment global data flows whilst delivering questionable benefits to the implementing countries.

International organisations and development institutions have been notably reluctant to address these dynamics directly. There is discomfort in appearing to lecture sovereign governments on their policy choices, particularly when those choices are framed in the language of resisting foreign domination. Yet the economic costs are real and fall disproportionately on the citizens and businesses of the implementing countries.

The question is not whether countries have the right to regulate data within their borders. They manifestly do. The question is whether the particular instrument of localisation mandates serves their interests, or whether it represents an expensive symbolic gesture that imposes costs without delivering control. For most smaller economies, the evidence points firmly toward the latter.

Alternative approaches exist but require sustained investment in regulatory capacity rather than infrastructure. Building expertise in competition policy, consumer protection, and technical standards takes years and lacks the political visibility of a new data centre. It demands institutions that can engage with technology firms as sophisticated counterparties rather than simply issuing mandates. This is harder work and offers fewer opportunities for ribbon-cutting ceremonies.

The natural experiment now underway across multiple jurisdictions will eventually yield data on which approaches prove most effective. In the meantime, businesses face rising costs and complexity. Smaller technology firms find themselves shut out of markets they cannot afford to enter with localised infrastructure. Consumers pay higher prices for services that work less well. And governments discover that sovereignty cannot be purchased simply by moving servers across a border.

What remains at stake is whether the next generation of digital regulation will be shaped by evidence of what actually works or by the political appeal of policies that appear decisive. The infrastructure trap is not inevitable. But escaping it requires a willingness to acknowledge that genuine control over data flows demands expertise and institutional capacity, not simply domestic hardware. For many smaller economies, that remains an uncomfortable conclusion.

This article was produced with AI assistance and reviewed against our editorial standards.