Most organizations have built their digital sovereignty strategy on a foundation that is necessary but insufficient: data residency. Choosing the right country for a data center addresses location. It does not address control, and control is where the actual risk lives.
This paper argues that digital sovereignty is not a destination reached by signing the right contract or locating data in the right jurisdiction. It is a risk profile built across eight distinct layers: strategic, legal, data and AI, operational, supply chain, technology, security, and environmental. Each layer carries its own exposure. Each can be assessed and improved independently. None can substitute for the others.