Building public authority for cloud governance and data sovereignty in Somalia under structural dependence

Abstract

Cloud computing now supports public administration, finance, health, communications, and platform-based services, but it also makes public control over data, jurisdiction, accountability, and critical digital infrastructure harder to exercise. These tensions are sharper in fragile and low-capacity settings where digital markets often expand faster than the institutions responsible for governing them. This article presents a qualitative single-case study of Somalia, supported by structured literature synthesis and document analysis, to examine how data sovereignty is shaped under conditions of infrastructural and institutional dependence. The analysis is anchored in governance-capacity theory under structural dependence: legal authority is treated as necessary but insufficient unless it is matched by institutional routines, infrastructure visibility, and leverage over systemically important private actors. Drawing mainly on peer-reviewed literature published between 2023 and March 2026, with older foundational works retained only where conceptually necessary, together with Somalia’s Data Protection Act of 2023 and related policy documents, the article argues that Somalia’s challenge is best understood as governance under structural dependence. Formal legal jurisdiction has begun to emerge, but available public evidence suggests that practical control remains constrained by thin regulatory capacity, externally mediated cloud and hosting arrangements, and the infrastructural power of telecom-fintech firms that already perform quasi-public functions. A credible policy pathway therefore requires sequenced hybrid governance: operationalizing the data protection regime, mapping critical cloud dependencies, using procurement and audit rights to improve visibility, imposing risk-based obligations on systemically important private actors, and coordinating regionally on cross-border data governance. More broadly, the Somali case suggests that digital sovereignty in fragile states should be treated as an uneven governance capacity that can be strengthened incrementally rather than as an all-or-nothing condition of technological independence.