Health Data Belongs to Citizens, Not Corporations: Brazil’s Path to Digital Sovereignty

Abstract The digital transformation of healthcare is reshaping how medical data are generated, stored, and governed, raising fundamental questions about sovereignty, accountability, and democratic oversight. As health systems increasingly rely on cloud infrastructures operated by multinational technology firms, the governance of sensitive health information is no longer solely a technical issue but also a geopolitical and ethical one. This commentary examines Brazil’s emerging approach to digital sovereignty in health data governance through the development of a government-operated sovereign cloud infrastructure led by national public institutions. We analyze how this model seeks to ensure that sensitive public-sector health data remain under domestic jurisdiction, consistent with Brazil’s General Data Protection Law (LGPD), while mitigating vulnerabilities associated with extraterritorial legal frameworks such as the U.S. Cloud Act. Brazil’s strategy illustrates how countries can pursue digital innovation while safeguarding national autonomy, citizens’ rights, and institutional resilience. The case contributes to broader debates on data sovereignty and the governance of digital infrastructures in the global health ecosystem.