Sovereignty mandates mislead security leaders into treating a vendor’s local data center as complete compliance. It is not, because where bytes sit says nothing about who can reach them.

This is the core argument of “Data Residency Is Not an Architecture,” published to LinkedIn on August 27, 2026 by newsletter author and commentator Andreas Hamberger. His central point: any real platform scatters data across several environments, and a residency clause typically pins down just one of them.

Hamberger identifies at least four environments. Beyond the primary store, there is processing (AI inference, for instance), plus logging and telemetry. For example, inference might run in a different region than the database while both are nominally “compliant.” A contract that names only storage leaves three pipelines unexamined. On vendor promises, he is blunt: a claim that “their Sydney region satisfies your cross-border obligations” is “not citing a determination. They are citing an assumption.”

The legal spine is New Zealand’s Privacy Act 2020. Section 214 lets the government designate countries with comparable privacy law; Hamberger reports that six years on, the tally is “zero countries,” and that a 2020 consultation on prioritizing candidates closed with no published response. We found no independent government record confirming either detail.

Two further claims rest on the article alone: that Australian and U.S. laws compel provider disclosure regardless of server location under a 2024 bilateral agreement, and that a vendor’s “processor” status may fall away under foreign compulsion. Hamberger himself frames the second as an untested legal argument, not settled doctrine.

The takeaway for federal and enterprise buyers: treat residency as an enforcement question. Audit access, inspection, and exit rights across every data location, not just the database.

Source: LinkedIn (Andreas Hamberger)