Confronting Cross-Border Data Risks

Digital sovereignty is reshaping global data governance, with the increasing fragmentation of regulatory regimes exposing firms to complex risks in cross-border data flows. However, existing research lacks theoretically grounded and empirically validated frameworks and tools from the firm perspective, limiting their practical utility in identifying and mitigating these risks. This study proposes a three-dimensional framework of cross-border data flow risk based on the institution–technology–organisation structure, with each dimension informed by institutional theory, socio-technical systems theory, and the New OLI Paradigm. An initial item pool was developed through literature review and Delphi consultation, followed by a two-stage survey with exploratory and confirmatory factor analyses, reliability, and validity testing. The resulting 12-item scale captures three key dimensions: regulatory complexity, data security and privacy, and business continuity. This framework offers both conceptual clarity and practical tools for firms navigating fragmented data environments.