Digital sovereignty refers to a state’s ability to retain decision-making power and control over its critical data, digital infrastructure, technology, and digital economy.
Just as a state protects its geographical borders and financial system, in the digital age it must also protect its data and infrastructure. This is not just about keeping servers inside the country, but about the collective capability to build local technology, secure payment systems, cloud, cyber security, and reduce external dependence.
In the absence of digital sovereignty, four major risks persist:
1. Data: If sensitive government information is stored in systems over which we have limited legal control, complications can increase in a time of crisis.
2. Cyber Security: The 2010 Stuxnet attack on Iran’s Natanz nuclear program proved that a cyber attack can also paralyze industrial systems.
3. Financial System: After Russian banks were removed from SWIFT in 2022, Russia activated SPFS and China activated CIPS as alternative systems.
4. Information: Social media has made communication easier, but these same platforms are also used for disinformation and organized propaganda.
Digital sovereignty rests on five pillars: Data sovereignty, economic and financial sovereignty, technological sovereignty, cyber security sovereignty, and informational and cultural sovereignty.
There are examples of this around the world. Europe created the General Data Protection Regulation (GDPR) and then protected digital sovereignty through Gaia-X. The aim was not to control the public, but to secure public and national data. To reduce foreign dependence, Russia has made the pre-installation of its local messaging app MAX mandatory on new phones and tablets from September 1, 2025.
In Pakistan, the National Cyber Security Policy 2021 and the Cloud First Policy have been approved. The biggest development is the approval of the National AI Policy 2025 by the Federal Cabinet on July 30, 2025. In payments, Raast is operating as the national instant payment system.
Recently, Sky47, in collaboration with ZTE, has established the Karakoram-01 data center in Islamabad, which was introduced in July 2026 as Pakistan’s first purpose-built, AI-ready campus. This is an important development for local cloud and AI.
However, digital sovereignty is not achieved by just building a data center. It also requires local software, cyber security, a skilled workforce, and strong data protection laws.
The real question is not where the server is located, but how much control we have over the technology running on it. Today, Pakistani users are benefiting from the services of large global companies, but we also have to think about what our alternative will be if access to a global cloud or financial network is restricted for any reason.
The solution is not to cut off from the world, but to create alternative capabilities. We have to strengthen local data centers, cloud, AI computing, and software development simultaneously while benefiting from global technology.
Digital sovereignty does not mean distancing from the internet, but the ability to make our own fundamental digital decisions at critical moments while remaining part of the global digital economy.
For digital sovereignty, Pakistan needs a strong data protection law like GDPR on the pattern of the European Union, technological self-reliance like China, and promotion of local technology instead of international apps like Russia, Japan and Korea, such as VK and MAX in Russia, LINE in Japan, KakaoTalk in South Korea and Zalo in Vietnam. Because digital sovereignty is power, not imprisonment.