Five pillars derived from the Charter. Thirty-one sub-indicators on a 0–10 rubric. Three layered data sources. A standing Correction Notice protocol. And a single Pearson coefficient that tells the story of why the Charter is needed at all.
The Index is the annual instrument by which the Custodian discharges its mandate under Article 12 of the Charter. The Index is published as the Report on Data Sovereignty Progress and is the principal vehicle by which the international community — citizens, States, institutions, and investors — may understand which Signatory States are actively advancing the principles of the Charter and at what pace.
The Index draws methodological inspiration from established international instruments: the Human Development Index, the SDG Index, the World Bank Logistics Performance Index, the World Bank Worldwide Governance Indicators, the WIPO Global Innovation Index, the Network Readiness Index, and the Government AI Readiness Index. Where useful conventions exist, the Custodian has adopted them. Where the Charter's specific commitments require departure from convention, the Custodian has departed and explained the departure.
Pillars are weighted equally at twenty percent each in Edition 1.0. Weights are subject to review at each annual cycle and any change is published prior to the cycle in which it applies.
Charter mapping: Articles 2, 4, 11.
The legal recognition, in domestic law, of the rights of the Data Owner and the limits on State authority over private data. This pillar measures whether the principles of the Charter are present in the constitutional, statutory, or framework law of the State, and whether the legal mechanisms necessary to vindicate those rights are available. Sub-indicators include: Data Sovereignty in framework law; Data Owner rights codified in statute; limits on State authority over data; the capital-crime exception narrowly framed and procedurally guarded; stated national-government policy refusing extraterritorial demands; a public registry of access requests; and the right of erasure with cryptographic verification.
Pioneer States to watch. Member States of the European Union benefit from the GDPR / Convention 108+ / adequacy framework. Council of Europe Convention 108 Parties and Convention 108+ ratifying States form the legal-recognition vanguard.
Charter mapping: Article 3.
The presence in operational practice of the four inviolable protections: encryption at rest, owner-permissioned access, owner retrievability, and owner retraction. This pillar measures whether the principles operate in fact in the State's public services, regulated industries, and reference systems. The pillar is not satisfied by the presence of policy alone — it asks for evidence that, in real-world operation, the technical apparatus delivers what the law promises.
Charter mapping: Articles 5, 6.
The presence of a Universal Identifier framework consistent with Charter Article 5, and the presence of a regime for the registration and accountability of Autonomous Agents under Article 6. This pillar measures whether the State has established the technical and legal scaffolding for cryptographic attribution of human and non-human action — both for natural persons (with consent) and for the artificial intelligences, robotic systems, and connected devices that increasingly act in the world.
Charter mapping: Article 7.
The presence of the physical, policy, and operational conditions for the State to function as a Sovereign Data Haven: stated national-government policy on extraterritorial demands; data-center capacity; sustainable cooling and power infrastructure; and trained security capacity for critical data infrastructure. Edition 0 finds Pillar IV with a global average of 3.38 / 10, lower than any other pillar — the dimension along which the world is least prepared.
Charter mapping: Articles 8, 10.
The presence of the institutional and educational infrastructure that supports long-term implementation: National Authority designation, legislative work in progress, Sovereign Compute Pilots, higher-education curricula, civil-society engagement, and Annual Survey participation. Edition 0 finds Pillar V leading the global pillar averages at 5.51 / 10.
Edition 0 is constructed from open-source data alone. Each sub-indicator is scored against a layered source stack — the table below shows the principal source datasets and what they contribute. The Office of the Custodian welcomes corrections and additional data from any State, scholar, or institution.
| Dataset | Provider | Used for |
|---|---|---|
| Global Cybersecurity Index 2024 | ITU | Pillar II — operational cybersecurity tier rating |
| UN E-Government Development Index | United Nations | Pillar V — digital service maturity |
| Cyberlaw Tracker | UNCTAD | Pillar I — comprehensive data-protection statute presence |
| Data Protection Laws of the World | DLA Piper | Pillar I — corroboration of UNCTAD-Cyberlaw entries |
| Constitute Project | Comparative Constitutions | Pillar I — constitutional-level recognition |
| Convention 108 / 108+ Party List | Council of Europe | Pillar I — international-treaty alignment |
| Adequacy Decisions Register | European Union | Pillar I — third-country adequacy status |
| ID4D Global Dataset | World Bank | Pillar III — foundational identity infrastructure |
| AI Policy Observatory | OECD | Pillar III, V — national AI policy presence |
| Global Data Center Markets | Cushman & Wakefield | Pillar IV — data-center capacity (top markets) |
| Global Data Center Trends | CBRE | Pillar IV — corroboration of capacity figures |
| Privacy Authority Registry | IAPP | Pillar I — designated supervisory authority presence |
| Open Government Partnership Membership | OGP | Pillar V — civil-society engagement signal |
Supplement A tests, against open-source data on global data-center infrastructure, whether and how strongly the world's investment in physical data-center capacity tracks the world's investment in the legal-constitutional and technical-operational frameworks that the Charter asks of States.
The world has invested heavily in the physical layer of data infrastructure. The top 100 markets host thousands of data-center facilities; the top fifteen alone host more than 8,000.
The world has invested less uniformly in the constitutional layer. Across the same top 100, the Pillar I average ranges from below 3 to above 8.8. The correlation between the two layers — at r = 0.352 — is only moderate-to-weak.
Read across all five pillars, the message is consistent: the global data-center build-out is, on the public record, ahead of the global build-out of constitutional and legal sovereignty frameworks for data. That gap is precisely what the Charter exists to close.
The methodology is published as a permanent, freely-downloadable reference. The data-rich Edition 0 report is a paid publication that funds the work of the Custodian. Both can be obtained from the Office of the Custodian.
Download the methodology (PDF)