Data sovereignty is not as simply as we thought
When the government passed Executive Order 119 to push for data privacy and sovereign data in Philippine soil, there’s more to the context than just having physical data centers to house private citizen data. Whenever you query into an AI tool, the data travels across boundaries and it is rarely within the Philippines given the country is behind by at least two years in the AI boom. This statistic was mentioned by Jimmy Go, President and CEO of VST ECS at the recent 2026 CXO Summit held in Boracay.
Although this data may be encrypted, it often is not audited.
Walter So, Managing Director of HPE Philippines, puts it plainly: real data sovereignty isn’t just about where data is stored. It’s also about data in transit.
The journey, not just the destination
Most conversations around AI infrastructure focus on where data ends up: from cloud, which data center, which country hosts it at rest. What gets less attention is the journey of that same data. Every time an enterprise AI tool processes a query through a public cloud endpoint, that data moves. And in sectors like healthcare, finance, and government, where the sensitivity of that data carries legal and national security weight, the movement matters as much as the storage.
The Philippine context makes this more pointed, especially with Executive Order 119. This has pushed data privacy and AI governance higher on the enterprise agenda. The instinct for many organizations has been to reach for public cloud tools like Microsoft Copilot, ChatGPT, Gemini; because they’re fast to deploy and familiar. But So draws a clear line between using AI and building AI infrastructure responsibly. A tool that processes your data through a public endpoint is, by definition, not private. Whatever assurances the vendor provides, the data has already left the building.
What data sovereignty actually means
The alternative HPE is advocating is private AI deployments where data doesn’t leave a controlled environment. In the strictest interpretation, that means an air-gapped system where transactions happen entirely within a locally controlled boundary, more commonly known as edge computing. In practice, most enterprises will land somewhere between full air-gap and full cloud — but the principle holds. Critical data should have a defined perimeter, and that perimeter should be as close to local and controllable as possible.
This isn’t abstract. So points to the vulnerability of undersea cables — infrastructure that, whether through foreign interference or natural disaster, has proven it can be cut. An enterprise whose entire AI operation depends on continuous cloud connectivity to a foreign data center has a business continuity problem waiting to happen.
The governance problem
The risk compounds once AI moves beyond simple queries into agentic territory. The deeper problem is accountability. Without a governance framework, nobody knows what the agent accessed, what it wrote, or what it changed. “The last thing you want,” So says, “is an AI agent deleting a database.”
The cost of getting the infrastructure wrong
HPE’s answer to the cost and risk equation is its GreenLake model — a consumption-based approach where enterprises pay for AI infrastructure as a service rather than owning it outright. The hardware sits either on the client’s premises or in a controlled data center, the client retains sovereignty over their data, and HPE handles maintenance, billing by usage, and technology refresh. When the hardware becomes obsolete, HPE replaces it. The client absorbs no capital risk on the depreciation cycle.
For Philippine enterprises navigating high GPU costs, tight capital budgets, and increasing pressure to demonstrate AI ROI, that last point matters. Owning a GPU cluster that’s obsolete in three years is a different financial proposition from consuming compute as a service from infrastructure that gets refreshed automatically.
The next two years
The harder question for most enterprises isn’t whether to build private AI infrastructure — it’s whether the investment pays off. So’s answer cuts through the usual hedging: the ROI conversation starts with use cases, not hardware. “You don’t create AI for the sake of AI. You create it for a specific use case that you see will benefit your business from a competitive standpoint.”
The Philippines has the adoption instinct — we are, by some measures, among the highest users of generative AI in Asia. Whether enterprises here can convert that into something deliberate and durable is the question the next two years will answer. And the answer, So argues, starts with something more fundamental than picking the right model or the right vendor.
Asked what the right posture is for Philippine enterprises navigating all of this, his answer is unambiguous: “The critical data should be here in the Philippines. That’s your sovereign data privacy. That’s your national security protection.”