Smart buildings increasingly rely on heterogeneous data sources, including real-time Internet of Things (IoT) streams, point cloud scans, and Building Information Modelling (BIM), to optimise energy consumption, safety, and operational efficiency. However, the integration of these data sources introduces significant challenges, particularly in terms of ensuring user privacy and data sovereignty across distributed systems. Building operators, tenants, service providers, and emergency responders often require access to overlapping datasets with different legal, organisational, and contextual constraints. Without appropriate governance mechanisms, data sharing risks violating privacy regulations and exposing sensitive information. To address these challenges, this paper first discusses the development of Personalised Data Hubs (PDHs) based on the International Data Spaces (IDS) concept, which integrates multiple data sets into a unified, compliant framework. Building on PDHs, we present the SmartData Interlock (SDI) model, a graph-based, sovereignty-aware access control and data exchange architecture that enables controlled data sharing, allows users to define their own access policies, and ensures regulatory compliance. SDI extends Category-Based Data Access (CBDA) models with purpose binding, delegation semantics, contextual constraint enforcement, and executable policy graphs for lifecycle-aware smart building governance. Using a realistic smart building policy graph, this work evaluates SDI performance and shows that secure data exchange can be achieved with bounded computational overhead, confirming its practical viability in smart building applications and urban planning.