Digital and Data Sovereigny: the applicable legal frameworks and the case study of the IoT

This report has been prepared in the context of the research and innovation programme entitled ‘SEcurity and RIghts in the CyberSpace- SERICS’ - theme 7 ‘Cybersecurity, new technologies and protection of rights’ and in particular for the project: ‘Digital sovereignty’ (DISE), financed, following the call ‘Human, social, and legal aspects’, to carry out activities in Spoke 1, no. 2, CUP: B53C22003950001, of Mission 4 ‘Education and Research’, component 2, (PE 0000014) of PNRR. Within the DISE project, the project proposal ‘Enforcement and Monitoring of Data Sovereignty policies’ (EMDAS) was funded, for the benefit of the partnership composed of the lead partner University of Naples Parthenope and the partner University of Trento (UNITN). The project was placed in WP1 of DISE. As indicated in the EMDAS project, the partnership’s activities aim at enhancing the cybersecurity and resilience of digital infrastructures, by enabling trust mechanisms in the data exchange, which is vital for their development, given the importance of data sharing for innovative business and public administration services in Italy and in the European Union. The research considers the complexity of ensuring high standards of confidentiality and reliability throughout the life cycle of such data. EMDAS includes the study, research and experimentation activities on: legal aspects of cybersecurity and privacy and digital technologies (Task 1.1. Analysis of the requirements deriving from the study of laws and regulations on digital sovereignty); tools and technologies for digital and data sovereignty (Task 1.2 Technologies to support digital sovereignty in particular for the definition and semi-automatic understanding of regulations); technologies for network security, technologies for security and data protection in the energy and transport domains (Task 1.3 Analysis of some socio-economic aspects of digital sovereignty). This report is included in Task 1.1. and is the result of research work carried out at the University of Trento. The legal unit consists of Prof. Paolo Guarda, Prof. Giuseppe Bellantuono, Prof. Roberto Caso (till September 2025), Prof. Matteo Ferrari, the researcher recruited for the project Dr. Giorgia Bincoletto (from February 2025) and the collaborator Razmik Vardanian. The research activity of Task 1.1 investigates various legal profiles related to the topic of digital and data sovereignty, considering cybersecurity and data protection issues upfront. The analysis was firstly started at a general level and then focused on three key technological contexts during the project. In Y1 the legal research was started on the notions of “digital sovereignty” and “data sovereignty”. Attention was first paid to definition and clarification. Then the research group collected and systematised laws, regulations and policies already in place and currently under development related to these notions in the European Union (EU) and the Italian legal frameworks. The research in Y2 was devoted to highlight the implications of the spread of digital technologies and data management and their data protection and cybersecurity issues in key context. This report includes the analysis of the Internet of Things and the guidelines proposed.