Most UK boards believe that storing data in a UK data centre means it is protected by UK law. It does not. This session unpacks the difference between data residency, which is where data physically sits, and data sovereignty, which is who legally controls it. It examines the regulatory and commercial consequences under regimes such as the US CLOUD Act, and sets out what technology and security leaders should actually do to manage the exposure