As countries race to build domestic data centers in the name of sovereign AI, Saudi Arabia is betting on a more creative idea: data embassies.
A data embassy is where data is stored outside of a country’s physical borders but operates under its laws, much like a diplomatic embassy.
The concept is not new. Estonia established the first data embassy in 2017 and there’s only been one other since, from Monaco. Both embassies are in Luxembourg and hold a backup of the countries’ critical data, set up as a security measure against cyber and climate risks.
As AI scales, the concept could gain momentum as a way to build data centers overseas — in places that have plenty of resources and power, given energy is one of Europe’s biggest bottlenecks in building AI infrastructure — while still operating within the laws of the developer’s country.
At least, that’s what Saudi Arabia is counting on as it positions itself as an exporter of data rather than oil. Saudi Arabia is betting hard on solar energy, but its water resources — needed to cool data centers — are scarce, dousing the idea in doubt. It comes as the country battles its neighbors to become an AI hub as global investors and tech firms turn to the Middle East for its deep pockets and influx of talent, representing a potential shift in global power.
Data embassy dealmaking
Getting data embassies up and running would be tricky in practice as they require bilateral international agreements on jurisdiction and there is currently no relevant legal framework in place, Viktor Mayer-Schönberger, professor of Internet governance and regulation at the University of Oxford, told CNBC.
The guest country and host state would have to agree on assurances that neither party is violating the terms of the agreement, Mayer-Schönberger, said. However, this will ultimately “depend on the trust of the parties involved,” he added.
Saudi Arabia, however, has set its sights on becoming the first G20 country to introduce such a framework. In April, its Global AI Hub Law draft set out three levels of data embassies, ranging from the guest country retaining full autonomy to hybrid legal protections where Saudi courts could assist foreign courts.
It is another example of how the AI race could reshape geopolitics as the Kingdom cozies up to the U.S. There has been no indication of the U.S. being a preferred partner for data embassies, but the pair has established a “Strategic Artificial Intelligence Partnership” with Saudi Arabia that includes the “building and developing advanced AI infrastructure.”
When asked whether the concept could solve tensions around ByteDance’s TikTok, where the U.S. feared its citizens’ data was being accessed by the Chinese government and used to influence voters ahead of the 2024 election, Mayer-Schönberger was not convinced.
“It would require a complex bilateral treaty between China and the US that would take very long to negotiate; moreover, given the distrust between the two nations, it is hard to imagine that the US would trust China to keep the data off limits,” he said.
Big Tech firms Google and Microsoft already offer their cloud computing customers with local data centers hosted in Europe for sensitive data, as well as a special governance structure designed to limit U.S. government access to that data.
“Whether such arrangements would actually protect the data from access remains to be seen, however,” Mayer-Schönberger said.
Pressing concerns, waning globalization
While concerns of data sovereignty have come into focus as globalization backslides and fresh emphasis is put on national security and economic competitiveness, there is little clarity on how regulations will evolve when it comes to embassies.
Sovereignty is an undefined term, noted Nathalie Barrera, who heads up privacy and data regulations in the EMEA region at Palo Alto Networks. “Everyone’s talking about it, but no one has defined it, meaning sovereignty for France looks different than sovereignty for Spain,” she told CNBC.
Palo Alto Networks’ customers care about three things: autonomy, which involves the protection of data, understanding who has access, and control; digital resilience to ensure uninterrupted services; and foreign government data access.
Barrera sees data embassies falling in the middle category, especially in the context of Estonia and Monaco.
“This is not unsimilar than the extra territoriality effect of GDPR,” she said, noting that there can be data in the U.S. that is still subject to European laws.
“And so, this is just a different option or a setup to protect certain categories of data, which, from my understanding, it’s pretty much sensitive data that the government needs to hold, such as tax information, health information, administrative information, from its citizens and employees,” she added.
Part of Saudi Arabia’s lure is its cost, as land for data centers is significantly cheaper, as is power and capital. The country is well positioned geographically as a connection between Europe, the Middle East and Asia.
“It makes sense if Saudi Arabia can offer data centre services at a lower cost than countries that need them,” said Hortense Bioy, head of sustainable investing research at Morningstar Sustainalytics.
However, “the rise of data centres introduces new ESG considerations which are now widely recognised, with carbon emissions and water intensity among the most pressing concerns.”
While the sun is plentiful in the arid state, its grid is still largely powered by fossil fuels. Around 64% of Saudi Arabia’s total energy supply was from oil in 2023, according to International Energy Agency data, suggesting in this case the trade-off for sovereignty could be sustainability.
In all, Mayer-Schönberger remains skeptical on the potential for data embassies to become the next big thing. “The nation state remains too powerful and globalization is waning,” he said.