By Anirban Mukherji, Founder & CEO, miniOrange
The next great geopolitical argument may not be about oil, territory, or shipping lanes. It may be about something far less visible: where a person’s data sits, who can access it and which country’s laws govern it.
That sounds like a question for lawyers and privacy officers. Increasingly, it is not. When someone opens a bank account, orders a product, visits a hospital or asks an AI assistant a question, their information can move through payment processors, cloud platforms, analytics systems, software vendors and artificial intelligence services, potentially touching several jurisdictions along the way. For the individual, this movement is almost invisible. For governments, it is becoming a matter of national consequence.
Personal data has moved from the privacy policy to the center of national policy because it now sits at the intersection of commerce, technology, security and sovereignty.
The world’s privacy rules are becoming borders
Europe’s GDPR was a turning point, giving individuals stronger rights while imposing greater accountability on organizations. More importantly, it established a principle with global consequences: personal data should remain protected even when it crosses national borders.
Brazil’s LGPD followed with its own comprehensive framework and rules for international transfers. In 2026, Brazil and the EU recognized each other’s data protection regimes, highlighting how regulatory compatibility is becoming important to global digital commerce.
India is building its own model through the DPDP Act and Rules, 2025, establishing obligations for data processing and individual right. Saudi Arabia’s PDPL similarly regulates transfers outside the Kingdom, with safeguards tied to national security and vital interests.
China’s PIPL combines personal information rights with broader data and national security considerations, including cross-border controls. The US has taken a more fragmented route through state privacy laws. Their differences point to the same shift: governments increasingly view personal data as a matter of national sovereignty.
The cloud made data global. Regulation is making it territorial
For years, the cloud made geography feel almost irrelevant. Data could be collected in one country, processed in another and analyzed somewhere else without the customer ever knowing where those operations occurred. That invisibility was part of the cloud’s appeal. It turned geography into an infrastructure detail rather than a business concern.
Privacy regulation is changing that equation. The location of data can now affect whether a service can be offered, which technology can be used, which supplier can be engaged and how an organization structures its operations.
AI makes this shift harder to ignore. Modern AI systems depend on vast volumes of information moving between applications, models, data stores and third-party services. When those systems operate across jurisdictions, the question is no longer simply whether data is protected. It is whether the organization can determine where its data is going, what is happening to it there and which authority ultimately governs that activity.
This creates a new tension for the digital economy. Global companies built their technology around scale, centralization and frictionless movement of information. Governments are increasingly asking for control, accountability and jurisdiction. The resulting friction will influence where companies build infrastructure, how they structure digital services and which markets they can serve from a common technology stack.
Then AI changed the question
Artificial intelligence has made this debate considerably harder. Traditional databases primarily stored information. AI systems can interpret it, combine it, infer from it, and use it to make predictions.
A person’s location history can reveal their routines. Financial activity can indicate vulnerability. Health records can reveal conditions that an individual may never have disclosed outside a clinical setting. A collection of seemingly harmless data points can become highly sensitive when an algorithm connects them.
The privacy question therefore is no longer limited to what an organization knows about a person. It is increasingly about what a machine can infer about them. This becomes particularly important as businesses introduce AI into customer service, healthcare, finance, recruitment, marketing and workplace applications.
An employee entering customer information into an AI assistant may not know where that information is processed, whether it is retained, or whether another service provider can access it. The organization may therefore face a question that did not exist in quite the same form before the AI era: was the data permitted to enter this system in the first place?
AI adoption is making privacy compliance an innovation issue
AI adoption is consequently making privacy compliance an innovation issue. The European Union’s AI Act does not replace GDPR. The two frameworks can operate alongside each other, creating a regulatory environment in which companies may have to consider both how an AI system is governed and how personal data is processed.
That convergence is likely to become more important as AI systems become embedded in everyday services. The biggest constraint on enterprise AI may not always be computing power or model performance. Increasingly, it may be whether organizations can use the data they have access to, in the places they want to use it, under the laws that govern it.
Privacy is becoming a question of power
There is a tendency to discuss privacy as though it were primarily about secrecy. It is not. Privacy is increasingly about power: who can see information about a person, who can combine it with other information, who can infer something from it, who can sell it and who can use it to make decisions.
That makes personal data valuable not only to businesses but to governments. Financial, health, identity and location data can reveal patterns across entire populations.
In the wrong circumstances, those patterns can become tools for surveillance, discrimination or manipulation. In legitimate circumstances, the same information can help governments deliver healthcare, detect fraud, improve public services or respond to emergencies.
Data localization can protect sensitive information and reduce dependence on foreign infrastructure. But excessive localisation can also fragment digital markets, raise costs and make international services harder to operate. The same policy that protects sovereignty can create a barrier to global innovation.
The new global bargain
This is the tension at the heart of the next phase of data governance. The world is unlikely to produce one universal privacy law. Countries have different political systems, legal traditions, economic priorities and views of state power.
Businesses operating globally will increasingly have to understand not just what personal data they possess, but where it resides, why it is being processed, which systems can access it, which vendors receive it, where it travels and what happens to it afterward. That requires something more substantial than a privacy notice. It requires evidence.
A company should be able to demonstrate how data moves through its systems, what permissions govern access, what safeguards accompany international transfers, and how personal information is handled when AI enters the process.
When privacy becomes accountability
For citizens, that distinction matters. A right to access personal information means little if an organization cannot locate it. A transfer restriction means little if nobody knows where the information went. An AI governance policy means little if sensitive information is already flowing into systems that the organisation cannot fully understand.
The future of privacy will therefore depend as much on visibility and accountability as on regulation itself. Personal data has become a matter of national policy because it has become a source of national power. It fuels digital economies, enables AI, supports public services, shapes markets, reveals citizens and increasingly influences decisions about those citizens.
The world’s digital borders are being redrawn. The real challenge now is not to stop data from crossing them. It is to decide what protections, responsibilities and rights must cross with it. If countries succeed, sovereignty and innovation can coexist. If they fail, the global digital economy could become a collection of disconnected data territories, each governed by its own rules and suspicious of the next.
The future of personal data will therefore be determined by a question far larger than privacy:
Who gets to decide what happens to information about us and under whose authority.