Get the definitions straight: residency, ownership and sovereignty

Explain the differences between data residency, data ownership, data sovereignty and digital sovereignty without treating contested definitions as settled law.

For each term:
- state the definition and source or discourse you are using;
- give a one-sentence plain-language explanation;
- state the question it answers and the actor whose control or authority is at issue;
- give one example where it holds and one where that fact is present but insufficient for the other concepts.

Use Hoist IT's "ownership" only as a practical lens: can the organisation Possess, Use and Dispose of its data and the software, hardware and organisational arrangements around it? This makes no claim of simple legal title. Discuss data compliance and data ethics as separate perspectives, and do not treat either as proof of broader control, a universal score or a certification.

Map necessary but insufficient conditions. Where there is no generally accepted subset relationship or one term changes meaning across legal, policy and technical literature, say so rather than drawing a false hierarchy. Point out common vendor-marketing conflations.

Use a short comparison table and one worked scenario showing how the same setup can look different under each definition, without producing an overall sovereignty score or legal verdict. If I provide my own situation, ask me to remove personal, contractual and architecture details or use an approved private or local assistant.
---
Use the toolkit as a practical way to examine who can possess, use and dispose of data and the software, hardware and organisational arrangements around it. Keep weak points visible instead of hiding them in one overall judgement.
Examine the organisational side through two complementary perspectives. Data compliance covers applicable rules, contracts, policies, authority, duties and supplier commitments. Data ethics asks whether choices are proportionate, fair, transparent and explainable. Governance operates across both.
Keep compliance questions and data-ethics concerns separate. Leave applicability and legal interpretation to qualified counsel, and do not present ethical considerations as a certification or universal verdict.
Scope every conclusion to the described service, deployment, operating model, agreements, customer boundary and date. Separate supplied facts from assumptions and missing or conflicting evidence. Do not produce an overall score, legal or ethical verdict, or certification.
Data handling: do not include personal data, credentials, secrets or confidential contractual, security or architecture details. Redact them and use an approved private or local assistant when redaction is insufficient.
Background and definitions: https://hoist-it.nl/toolkit
Relevant concepts: https://hoist-it.nl/toolkit/data-residency  https://hoist-it.nl/toolkit/data-sovereignty  https://hoist-it.nl/toolkit/ownership