Data Sovereignty and Cross-Border Data Flows: An International Commercial Law Perspective

Abstract

Assertive claims of data sovereignty—mandatory localization, extraterritorial processing rules, and security-driven exclusion of foreign access—now sit in direct tension with the data flows on which cross-border commerce depends. The dominant scholarly treatment of this tension proceeds through the lens of fundamental rights and surveillance law. This article proceeds instead from international commercial law: the body of World Trade Organization law and preferential trade agreements, private international law, commercial contract regimes, and dispute-resolution instruments that govern transnational business dealings. The article first develops a taxonomy of data-sovereignty claims and shows why, as a matter of legal structure, such claims operate not as dominion over data itself but as jurisdiction over persons and infrastructure. It then maps the three principal regulatory models—the European Union's rights-based unilateralism, the United States' market-driven default with security-driven edges, and China's security-development dualism—together with the collisions among them. Against the developments of 2024–2026, including the expiry of the WTO customs-duty moratorium, the interim arrangements for the WTO Agreement on Electronic Commerce, the unsettled USMCA joint review, the EU Digital Omnibus proposal, and the recalibration of China's export-review thresholds, the article evaluates how trade law disciplines the form of data-sovereignty measures while leaving their substance intact, and how contract, choice-of-law, and arbitration regimes have become carriers of public regulatory law. It closes with a framework for reconciling regulatory competence with data mobility: differentiation by data type and risk, interoperable recognition mechanisms, and a rebuilt private-law infrastructure for data transactions.