Data sovereignty

What it means

Data sovereignty is the requirement that data be subject to the law and control of the country or the EU where it originates, and that foreign authorities have no access to it outside a legal framework. It concerns not only where data is physically stored but also which law the provider is subject to.

The topic gained weight with the spread of cloud services from large American and Asian providers. Even when servers are in Europe, the provider may be subject to foreign laws that allow authorities there to demand access to customer data.

Several European rules shape data sovereignty: the GDPR with its rules on international data transfers, NIS2 on the cybersecurity of important entities, and the Data Act, which among other things makes it easier to switch between cloud providers.

How it works in practice

When choosing a cloud solution, a company should ask where data is stored and processed, who can access it including support staff, which law the provider is subject to and how one can leave the service. The answers should be written into the contract, not just the marketing material.

For transfers of personal data to the US, companies can rely on the EU-US Data Privacy Framework if the recipient is certified. Similar mechanisms have, however, been struck down by the courts before, so it is wise to have a fallback ready.

Organisations with sensitive data, for example in the public sector, healthcare or financial services, often choose a hybrid cloud: the most sensitive data stays in their own or a European environment, while less sensitive services run with global providers.

What to watch out for

Storing data in a European data centre does not by itself guarantee sovereignty. It also matters who controls the encryption keys and whether the provider can be compelled to hand over data under foreign law. Encryption with keys under the customer's control reduces the risk considerably.

Data sovereignty requirements may differ by sector and type of data. Before migrating important systems to the cloud, it is worth carrying out a risk assessment and, for personal data, a data protection impact assessment, so that the company can defend its decision in an inspection.