Government Cloud and Data Sovereignty in Sri Lanka

Sovereignty Is a Design Constraint

Citizen identity, tax, and trade data often cannot leave approved jurisdictions. Cloud migration for government is therefore not a pure cost exercise — it is an architecture decision about residency, access control, encryption, and auditability.

Practical Options for Sri Lankan Agencies

Many workloads fit commercial cloud regions in Southeast Asia with contractual and technical residency controls. Highly sensitive systems may require hybrid models: sensitive databases on-prem or in sovereign environments, with public portals and non-sensitive services in cloud.

• Classify data: public, internal, confidential, restricted
• Map each class to allowed hosting locations
• Use encryption keys under agency-controlled KMS where required
• Prefer managed identity and least-privilege IAM
• Document subprocessors for procurement and audit

Avoiding Lock-In While Moving Fast

Use open standards for APIs and portable containers where practical. Separate application code from cloud-specific managed services at the edges. Plan backups and exit drills — sovereignty includes the ability to move if policy changes.

Security Baseline

Regardless of cloud choice: private networking, MFA for officers, continuous logging, vulnerability management, and tested incident response. Cloud does not remove the need for secure SDLC — it makes gaps more visible.