general term
Data sovereignty
Data sovereignty is the ability to know and decide where data is stored and processed, who can access it, how long it is kept and how it can be retrieved or deleted.
The GDPR does not use the phrase, but it regulates each of these questions separately: who processes data on whose behalf, under what conditions data leaves the European Economic Area, what rights people have and how long data may be kept. For a practice, data sovereignty means being able to answer those questions, with documents, for every tool you use.
Fictitious example
Before signing up for a scheduling service, you ask for the data processing agreement and the list of sub-processors. You find that backups are stored outside the European Union and that the export includes appointments but not notes. With that information, you decide whether the service suits you.
What to check
- That the provider signs a data processing agreement and gives you the list of sub-processors.
- Where each type of data is hosted and processed, including backups and technical support.
- That you can export your data in a usable format and know how it is deleted when you close the account.
Inside nexmin
The security page explains where nexmin hosts data and what you can configure. You can request the data processing agreement and information about providers at hola@nexmin.ai. In paid accounts, all processing will take place in the European Union.
security measures and data processing →Limit
For compliance, purpose, access, security measures and retention periods count as well.
Related terms
Sources
- European Parliament and Council of the European Union. Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) (27/04/2016), Arts. 15 to 20 (rights), 28 (processor) and 44 to 49 (international transfers).
- nexmin. Guía de herramientas digitales para la consulta terapéutica, versión 1 (in Spanish) (24/09/2026), ch. 3, on privacy questions for providers.
Sources checked on 04/10/2026.
Last updated: 2026-10-04