The Borderless Cloud is a Myth
With tightening GDPR, CCPA, and regional data localization laws, the idea of a central "global data lake" is becoming a legal and operational liability. The alternative is a federated approach in which data never leaves its jurisdiction of origin.
Models are trained on local data, and only the gradients — mathematical abstractions of what was learned — are shared to update the central model. This preserves the collective intelligence of the global system while keeping raw records in place.
One caveat is routinely missed, and it matters: sharing gradients is not automatically anonymisation. Gradient inversion attacks can reconstruct training inputs from updates alone, so federation reduces exposure but does not by itself discharge a data-protection obligation. Treat gradients as personal data until a differential-privacy budget or secure aggregation says otherwise, and have counsel confirm the position per jurisdiction rather than inferring it from the topology.
Federated Learning in Practice
Training nodes are deployed into specific regions — Frankfurt for EU data, Singapore for APAC. Each node reads the raw data in place, performs training passes and computes weight updates, which are encrypted and sent to a central aggregator.
The aggregator combines weights from all regions into an improved global model, which is pushed back out to the edge. Raw personally identifiable information never crosses a border, and the residency requirement is enforced by the topology rather than by policy documents that nobody re-reads.