Data Sovereignty: The Missing Foundation of Sustainable and Trusted Supply Chains

Why ASEAN’s next generation of sustainable industrial ecosystems must protect not only physical resources,

but also the data that gives them value

By Ir. Ts. Prof. Dr Chee-Fai Tan

Vice President (Technology), Malaysia Association for Sustainable Supply Chain & Innovation (MASSCI)

Deputy Vice-Chancellor, Kuala Lumpur University of Science & Technology (KLUST)

When we talk about sustainable supply chains, the conversation usually begins with carbon emissions, renewable energy, responsible sourcing, waste reduction and the circular economy. These are undoubtedly important priorities. However, as supply chains become increasingly digital and interconnected, there is another critical resource flowing through the ecosystem that deserves far greater attention, which is “data”.

Today, almost every activity within a supply chain generates data. Purchase orders create transaction data, machines and energy meters generate operational and consumption data, logistics systems capture movement and location information, while supplier assessments and sustainability reporting generate increasingly valuable ESG and carbon data. As companies accelerate their digital transformation, this information is no longer confined within the boundaries of a single organisation. It moves continuously between manufacturers, suppliers, logistics providers, customers, cloud platforms, AI systems, technology partners and regulators.

This growing dependence on data raises an important question, who controls the data behind our sustainable supply chains? As organisations increasingly rely on digital platforms and artificial intelligence to make procurement, production, logistics and sustainability decisions, understanding where critical data resides, who can access it, how it is being used and under whose jurisdiction it is processed becomes increasingly important.

This is why I believe data sovereignty should no longer be viewed simply as an IT, cybersecurity or regulatory issue. It has become a boardroom issue because data increasingly represents business value and strategic knowledge. It is a sustainability issue because carbon accounting, ESG reporting and supply chain traceability depend on reliable information. And it is a competitiveness issue because organisations that can govern, protect and responsibly utilise their data will be better positioned to participate confidently in increasingly digital and sustainability driven global value chains.

Ultimately, there can be no truly sustainable digital supply chain without trusted data. And there can be no trusted data ecosystem without appropriate governance over how that data is collected, stored, accessed, shared, used and protected. As we build the next generation of sustainable supply chains, we must therefore recognise that managing physical resources responsibly is only part of the equation. We must also manage the data behind those resources responsibly.

The Supply Chain Is Becoming a Data Chain

Consider a manufactured component moving through an international supply chain. Its physical journey may begin with raw materials, followed by processing, manufacturing, assembly, testing, transportation and, eventually, delivery to the customer.

But alongside this physical journey, there is now a second journey taking place: a data journey. At every stage, information is being created about the material’s origin, supplier, production process, quality, energy consumption, carbon footprint, transportation history and sustainability credentials. Increasingly, the physical product and its digital history are becoming inseparable.

A customer today may want to know not only whether a component meets technical and dimensional specifications, but also where its materials came from, how much carbon was embedded in its production, whether its suppliers complied with environmental requirements, and whether the sustainability claims can be independently verified.

This is becoming more important as sustainability requirements extend deeper into global value chains. The GHG Protocol, for example, provides a framework for companies to account for emissions across both upstream and downstream activities, while also highlighting the importance of supplier specific primary data in improving the quality of Scope 3 emissions reporting.

At the same time, mechanisms such as the European Union’s Carbon Border Adjustment Mechanism are making embedded-emissions information increasingly relevant to international trade. For affected products entering the EU, the ability to measure, document and verify carbon-related data is no longer only a sustainability exercise. It can directly influence market access, customer confidence and commercial competitiveness.

For ASEAN businesses, the implication is clear. As supply chains become more connected, automated and sustainability driven, companies are no longer managing only the movement of materials and products. They are also managing the movement of information, evidence and digital trust across organisational and national boundaries.

Sustainability is therefore becoming increasingly data dependent. The ability to generate, govern, share and verify

trusted data will become just as important as the ability to manufacture efficiently and sustainably.

What Does Data Sovereignty Really Mean?

Data sovereignty is sometimes interpreted simply as requiring data to remain within national borders. While data location is certainly one part of the discussion, I believe this interpretation is too narrow for modern industry and increasingly complex global supply chains.

For an industrial organisation, the more practical issue is control. Where is our critical data stored and processed? Who can access it, and for what purpose? Under which jurisdiction is it governed? Who owns the data and the insights generated from it? Can a cloud or technology provider retain or reuse the information? Can it be transferred to another party? If we decide to change platforms or service providers, can we retrieve our data in a usable form? And perhaps most importantly, do we really understand how our data moves across suppliers, customers, digital platforms and national borders?

These questions have become increasingly important because data today rarely remains within a single organisation. A manufacturer may depend on cloud infrastructure in one country, an AI platform operated from another, suppliers located across several economies, and customers requiring sustainability information in yet another market. A single industrial dataset may therefore pass through multiple systems, organisations and jurisdictions before it contributes to a business decision.

Data sovereignty, therefore, should not be about preventing data from moving. Modern supply chains simply cannot operate effectively in isolation. ASEAN manufacturers are deeply connected to regional and global value chains, while cloud computing, artificial intelligence and digital platforms increasingly rely on distributed infrastructure and cross border collaboration.

The real objective should be to enable data to move with appropriate control, accountability and transparency. I describe this principle as: Sovereignty without isolation. Connectivity without losing control. This distinction is important. Data has tremendous value when it can be responsibly shared and used. The challenge is to ensure that organisations remain aware of where their critical information is going, how it is being used and what rights they retain over it. In this sense, data sovereignty is not an obstacle to digital transformation. Properly designed, it creates the trust needed for digital transformation to scale.

Sustainable Procurement Is Becoming Data-Driven Procurement

From the MASSCI perspective, this issue becomes particularly important in sustainable procurement. For decades, procurement decisions have largely been driven by three fundamental considerations: cost, quality and delivery. These remain essential, but they are no longer sufficient. Companies are increasingly expected to understand the environmental and social impact associated with what they purchase and from whom they purchase it. Procurement teams may now need to consider a supplier’s carbon intensity, energy use, environmental performance, responsible sourcing practices, circularity, resilience and broader ESG risks. This means that sustainable procurement increasingly depends on information coming from organisations outside the buyer’s direct control.

Digital transformation is making it possible to manage this complexity. Digital procurement platforms can consolidate supplier information, while artificial intelligence can analyse large numbers of suppliers, identify risk patterns and support sourcing decisions that incorporate both commercial and sustainability considerations. In future, AI may increasingly help procurement teams compare suppliers not only according to price and lead time, but also according to carbon footprint, sustainability performance and supply-chain risk.

However, there is a fundamental principle that we should not overlook: We should not automate trust before establishing the quality of the data upon which that trust depends. An AI system may be extremely sophisticated, but if the supplier information feeding that system is inaccurate, outdated, incomplete or unverifiable, the technology may simply process unreliable information more efficiently. More automation does not automatically create more trust.

This is why the challenge is not simply to collect more data. Organisations need to understand the provenance, quality, ownership, integrity and accountability behind that information. Where did the sustainability data originate? Who provided it? Can it be independently verified? Has it been modified? Is the methodology consistent? And can the organisation continue accessing the evidence if a digital platform or technology provider changes?

These questions become particularly important for Scope 3 emissions and supply-chain sustainability, where organisations often depend heavily on information supplied by upstream and downstream partners. The deeper sustainability requirements move into the supply chain, the more dependent companies become on data that they do not generate themselves. This is where data sovereignty and sustainable procurement converge.

Sustainable procurement requires visibility beyond the first tier of suppliers, while data sovereignty provides the governance needed to ensure that the information supporting those decisions remains trustworthy, appropriately controlled and accountable.

For MASSCI, this represents an important evolution in how we should think about sustainable supply chains. We are no longer managing only the movement of goods, materials and resources. We are increasingly managing the movement of trusted information that allows organisations to prove where products came from, how they were produced and whether sustainability commitments have genuinely been met. In other words, sustainable procurement is becoming data-driven procurement, and data governance is becoming part of sustainability governance.

AI Changes the Equation

Artificial intelligence makes the question of data sovereignty even more urgent. Across industry, AI is beginning to influence demand forecasting, inventory planning, supplier selection, predictive maintenance, logistics optimisation, energy management, carbon accounting and ESG analysis. Used well, these applications can help companies make faster decisions, reduce waste, improve resource efficiency and identify sustainability risks that would be difficult to detect manually.

But there is a fundamental reality behind every AI application: AI is hungry for data. As organisations rush to capture the benefits of AI, enormous amounts of industrial information may be moving into AI platforms. Production records,

machine data, engineering documents, supplier information, maintenance histories and operational knowledge may all become inputs for AI-assisted decision making.

The immediate focus is often on what the AI can produce. We should pay equal attention to what happens to the data we provide. Where is that information processed and stored? Is it retained after the interaction? Who can access it? Can it be reused to improve another model or service? Does the organisation retain ownership and control over the insights generated from its data? And when the relationship with a technology provider ends, can the organisation retrieve its information, knowledge and digital assets in a usable form?

These are not merely technical questions. They are strategic business questions because industrial data can represent decades of accumulated engineering knowledge. Process recipes, machine parameters, product designs, quality methodologies, maintenance practices, supplier intelligence and operational experience are often part of what makes one company more competitive than another.

This is why my concern about data sovereignty goes far beyond protecting databases or determining where servers are located. For industrial organisations, data sovereignty is ultimately about protecting the digital representation of engineering know-how and preserving the organisation’s ability to control and benefit from it.

Generative AI adds another dimension. It has become remarkably easy for information to move from an organisation

into an external AI environment through an everyday prompt, uploaded document or automated integration. The technology may be convenient, but convenience should not remove accountability. Organisations therefore need clear governance over what information can be shared with AI systems, which platforms are approved, how outputs are validated and where human accountability remains necessary.

Responsible AI and responsible data governance must consequently develop together. We cannot build trusted AI on data that we do not understand, cannot verify or no longer meaningfully control.

From Carbon Accounting to Carbon Intelligence

Carbon management provides a useful example of how AI, sustainability and data sovereignty are beginning to converge. Traditionally, carbon accounting has largely been a process of collecting historical information, applying recognised methodologies and preparing reports. Digital transformation is changing this model. Data can increasingly be captured directly from electricity meters, machines, manufacturing systems, ERP platforms, logistics providers and suppliers. AI can then analyse these datasets to identify carbon hotspots, forecast future emissions, compare scenarios and recommend improvements.

The information journey begins with a physical activity, such as manufacturing, energy consumption or transportation, which generates operational data. This data is then used to perform carbon calculations, providing a measurable picture of the associated environmental impact. AI analysis can further interpret the information, identify patterns and carbon hotspots, and generate insights for improvement. These insights contribute to credible ESG disclosure and ultimately support better-informed business decisions. In this way, physical activity, operational data, carbon measurement, AI and ESG reporting form a connected information chain in which the quality and integrity of data at every stage directly influence the reliability of the final decision.

This represents an important transition from carbon accounting to carbon intelligence. Instead of merely reporting

what happened, organisations can increasingly use data to understand why it happened, predict what could happen next and determine what actions could reduce the environmental impact. However, greater intelligence also creates greater dependence on data.

A sophisticated AI model cannot compensate for inaccurate meter readings, inconsistent supplier information or poor-quality operational records. If the underlying information is unreliable, the resulting carbon calculation and ESG disclosure may also be unreliable. This leads to an important principle: Carbon intelligence requires data integrity. ESG credibility requires data provenance. Sustainable supply chains require both.

We should therefore stop viewing data governance and sustainability governance as separate disciplines. As sustainability becomes increasingly digital and AI enabled, data governance is becoming part of sustainability governance.

Blockchain Helps, But Technology Alone Cannot Create Trust

Blockchain and distributed-ledger technologies are frequently discussed as solutions for supply-chain traceability. They can certainly provide value by creating tamper-evident records for material provenance, certifications, transactions and selected carbon-related applications.

However, we should be careful not to confuse the immutability of a digital record with the truthfulness of the information contained within it. Blockchain can make a record difficult to alter. It cannot make incorrect information true. If inaccurate information enters a system at the beginning, preserving that information securely does not improve its accuracy. The same principle applies to AI: advanced technology does not automatically transform poor-quality information into trusted information. A trusted sustainable supply chain therefore requires an ecosystem rather than a single technological solution.

Reliable data capture, digital identity, cybersecurity, interoperability, verification, governance and clearly defined responsibilities all need to work together. Technology can provide the infrastructure for trust, but governance creates the conditions for trust.

A MASSCI Perspective: Five Foundations of a Trusted Sustainable Supply Chain

From the MASSCI perspective, I believe the next generation of sustainable supply chains should be built around five interconnected foundations, namely, sustainability, digitalisation, sovereignty, traceability and trust. Sustainability defines the outcomes we seek, while digitalisation provides the visibility and intelligence needed to understand increasingly complex supply chains. Data sovereignty ensures that strategically important information remains appropriately governed and controlled, while traceability provides the evidence needed to verify the origin, movement and sustainability performance of products and materials. Together, these foundations create trust, enabling organisations to collaborate, share information and participate confidently in increasingly digital and sustainability-driven global value chains.

Sustainability defines the outcome we want to achieve, such as responsible use of resources, lower environmental impact, greater resilience and the creation of long term economic and social value. Digitalisation provides the visibility needed to understand increasingly complex operations and supply chains. Without good data, many sustainability ambitions remain difficult to measure and manage.

Sovereignty ensures that organisations retain appropriate control over strategically important information. It requires clarity about who can access, process, transfer and reuse data, while still allowing legitimate data flows and collaboration. Traceability connects physical products with their digital histories. It allows businesses to understand where materials originated, how products were manufactured and transported, and whether sustainability requirements were met along the journey.

Finally, trust converts these capabilities into economic value. A supplier that can demonstrate credible sustainability performance becomes more valuable to customers. A manufacturer capable of providing reliable product-level sustainability information becomes better positioned to respond to international market requirements. An ecosystem capable of exchanging trusted information can collaborate with greater confidence. These five foundations should not be implemented independently. Their real value comes from their integration. Sustainability provides the purpose, digitalisation provides visibility, sovereignty provides control, traceability provides evidence, and trust provides value.

Data Sovereignty Must Move from the Server Room to the Boardroom

For this reason, I strongly advocate that data sovereignty must move from the server room to the boardroom. For too long, discussions about data have been delegated primarily to IT, cybersecurity or compliance teams. These functions remain essential, but the economic and strategic importance of industrial data means that boards and senior management must become directly engaged.

Leadership teams should understand what their most valuable industrial data is, where it resides and where it travels. They should know which suppliers, technology providers, cloud platforms and AI systems can access it. They should understand which business and sustainability decisions depend on that data and what would happen if the organisation suddenly lost access to it.

They should also ask a question that is often overlooked during digital transformation: If we need to change technology providers tomorrow, can we take our data, knowledge and digital capabilities with us? These are questions of business continuity, strategic autonomy and organisational resilience, not simply IT administration.

The objective of data sovereignty is not to lock information away. Data creates greater value when it can be responsibly used, analysed and shared. The objective is to give organisations the confidence to use, share and extract value from data without unnecessarily surrendering control over it.

ASEAN’s Opportunity: Building Trusted Digital Ecosystems

This creates an important opportunity for ASEAN. Our region is deeply embedded in global manufacturing and supply chain networks. Components may cross several national borders before becoming finished products, while the information associated with those components may travel even further through cloud platforms, customer systems and AI applications. Digitalisation will only deepen these connections.

ASEAN should therefore avoid framing the future as a choice between unrestricted data movement and excessive data isolation. What we need are trusted industrial data ecosystems that enable information to move where legitimate business needs require it while maintaining appropriate governance, accountability and protection. This is particularly important for SMEs. Smaller manufacturers and suppliers are essential to ASEAN’s industrial ecosystem, but many do not have the digital resources of multinational corporations.

They should not have to surrender control over valuable industrial knowledge simply because they rely on external cloud, AI or digital-platform providers. At the same time, sustainability and data requirements should not become so complex that SMEs are effectively excluded from global value chains Governments, technology providers, universities, industry associations, large corporations and supply-chain partners therefore have a shared responsibility to develop practical standards, affordable technologies, interoperable systems and workforce capabilities that enable companies of different sizes to participate confidently.

From the MASSCI perspective, this means bringing together three agendas that have too often developed separately: Sustainability. Digital transformation. Data sovereignty. Increasingly, we cannot advance one successfully without considering the other two.

The Next Competitive Advantage Is Trust

For decades, companies have competed to build supply chains that are faster, cheaper and more efficient. Those objectives will remain important, but the next generation of global supply chains will increasingly compete on another dimension: trust. Can customers trust the carbon information attached to a product? Can manufacturers trust sustainability declarations provided by their suppliers? Can regulators and buyers trust digital certificates? Can management trust recommendations generated by AI? And can an organisation trust that its strategically important industrial information remains appropriately governed as it moves across increasingly complex digital ecosystems? Every one of these questions eventually returns to data.

This is why I believe data sovereignty should become a strategic priority for sustainable industrial development. It should not be approached primarily through fear of losing data or restricting its movement. It should be approached as a capability that enables organisations to participate more confidently in the digital economy.

The sustainable supply chain of the future will therefore not be built only with greener factories, renewable energy, circular materials and efficient logistics. It will also be built on trusted data. Sustainability tells us what we need to achieve. Digital transformation gives us the capability to achieve it at scale. Artificial intelligence gives us the intelligence to optimise it. Data sovereignty gives us the confidence and control needed to trust the digital ecosystem supporting it.

For ASEAN, the opportunity is not simply to create greener supply chains. It is to build industrial ecosystems that are smart, sustainable, resilient, sovereign and trusted. And perhaps the most important change in mindset is also the simplest: Data is no longer merely supporting the sustainable supply chain. Data is becoming part of the sustainable supply chain itself.

About the Author

Ir. Ts. Prof. Dr Chee-Fai Tan is the Vice President (Technology) of the Malaysia Association for Sustainable Supply Chain & Innovation (MASSCI) and Deputy Vice-Chancellor of Kuala Lumpur University of Science & Technology (KLUST). He is an engineering and technology leader with extensive engagement in artificial intelligence, smart manufacturing, robotics and industrial digital transformation.

Prof. Tan is a strong advocate for data sovereignty, responsible AI and trusted technology adoption, particularly at the intersection of industrial competitiveness, sustainable supply chains and digital transformation. His work brings together industry, engineering, academia and international collaboration to advance practical approaches to trusted and sustainable industrial ecosystems.