Search for a command to run...
Not Just Because of GDPR
No comments yet. Be the first to comment.
What nobody draws Most organizations have architecture diagrams. They show services, databases, APIs, infrastructure. What they rarely show is how teams relate to each other, who depends on whom, wher
The decision nobody documents Most architecture diagrams show services. What they don't show: where one team's responsibility ends and another's begins. That boundary is where most long-term architect
The first workshop The first time I facilitated a Domain Driven Design workshop, we filled three whiteboards with context boundaries in two hours. Six months later, half of those boundaries had been r
Reality, Options, and Uncomfortable Truths
Cloud isn’t “just IT” anymore. It’s tied to business risk, compliance, resilience, speed and more than ever trust. That’s why the term Sovereign Cloud keeps showing up in RFPs, board discussions, and security roadmaps.
A lot of people still reduce Sovereign Cloud to “data stays in the EU.” That’s part of it, but it’s not the core. The real question is: Who controls access, operations, and legal exposure—and can you prove it when auditors, regulators, or customers ask?
This article gives you a clear explanation (no buzzword soup) and 7 concrete reasons why Sovereign Cloud is gaining momentum right now, well beyond GDPR.
There’s no single global definition and that’s one of the practical challenges. But in real-world procurement and architecture work, a consistent core has emerged:
Sovereign Cloud describes cloud environments designed and operated so that organizations have verifiable control over data, access, operations, and legal/jurisdictional exposure typically aligned with EU/EWR requirements.
Important: “sovereign” isn’t a binary label. It’s a spectrum. Typical building blocks include:
Data residency: Data (and ideally metadata/logs) remain in specific regions.
Operational sovereignty: Clear rules for operations, support, admin access, change management often regional, with strong governance.
Legal/jurisdictional sovereignty: Reduce exposure to foreign legal reach (e.g., disclosure orders) where possible.
Key sovereignty: Encryption keys are under your control (or a trusted EU entity), not “somewhere in the provider’s stack.”
Auditability: Evidence, reports, certifications, contracts you can actually use in audits.
GDPR is always in the background. But the current push comes from several forces hitting at the same time.
Since the Schrems II ruling (CJEU, 16 July 2020), companies have had to treat international data transfers and access risks more seriously especially where foreign public authority access can’t be ruled out.
On top of that, the legal question isn’t only “Where are the servers?” but also “Who can be compelled to provide data?” The U.S. CLOUD Act, for example, is commonly discussed in the context of orders that can apply when data is within a provider’s “possession, custody, or control,” even if stored outside the U.S.
The European Data Protection Board (EDPB) has also been explicit about the need for additional technical and organizational measures (“supplementary measures”) when transfer tools alone don’t guarantee adequate protection.
Why Sovereign Cloud helps here: It targets exactly these pressure points: tighter control of access paths, stronger governance, clearer key management options and critically better documentation so you’re not improvising during audits.
NIS2 expanded the scope of cybersecurity obligations across the EU and pushed risk management, incident handling, and supply-chain security higher on the agenda. Member States were required to transpose NIS2 into national law by 17th October 2024\>.
What many teams underestimate: NIS2 isn’t “just a security program.” It forces organizations to manage provider dependencies more systematically meaning cloud choices, operating models, and access governance become very real, very fast.
ENISA also published technical implementation guidance (June 2025) to support entities in implementing cybersecurity risk management measures in practice.
Why Sovereign Cloud helps here:
more structured operational and admin-access models
stronger governance and separation concepts (depending on the offering)
better audit-ready evidence (controls, logs, reports)
If you take NIS2 seriously, you’ll almost inevitably end up asking: “How sovereign is our cloud operating base?”
The EU’s Digital Operational Resilience Act (DORA) applies from 17th January 2025. It raises expectations for ICT risk management, resilience testing, incident handling, and importantly third-party risk and outsourcing.
DORA is especially relevant if you’re in finance (or working with financial clients), because it pushes cloud outsourcing governance and operational resilience into a more formal, evidence-driven regime.
Why Sovereign Cloud helps here: Many sovereign-oriented setups are built for regulated workloads: tighter access governance, clearer separation, stronger auditability, and more explicit continuity/exit thinking. That aligns well with the kind of operational discipline DORA expects.
Sovereignty isn’t only about “protection from outside.” It’s also about freedom of movement your ability to change direction without rewriting your business.
The EU Data Act includes provisions to facilitate switching between “data processing services” (often discussed in the context of cloud) and reduce lock-in effects. Multiple legal analyses point to the Data Act being applicable from 12th September 2025, including for cloud switching provisions.
Why Sovereign Cloud helps here:
Sovereign strategies are often bundled with clearer contracts, exit concepts, and transparency
Multi-cloud and hybrid approaches become more realistic when switching isn’t just a slide deck
You’re building a cloud foundation that doesn’t “stick” to one vendor by accident
Digital dependencies have become strategic dependencies. That’s no longer a niche argument regulators and governments are actively shaping policy around it.
In January 2026, reporting highlighted EU plans to phase out telecom equipment from “high-risk” suppliers in critical infrastructure, widely seen as targeting specific foreign vendors, and also broader pushes to strengthen ICT supply chains.
At the same time, the EU Cybersecurity Act is under review, with discussions around certification frameworks and how to keep pace with evolving risk and market realities.
Why Sovereign Cloud helps here: Sovereign Cloud is one pragmatic response to the “dependency problem.” It’s not about cutting off global tech it’s about creating options: regional operations, stronger governance, and more control over privileged access, especially for critical workloads.
AI is pushing more sensitive data into cloud platforms: training data, prompts, embeddings, telemetry, logs. Depending on your use case, that can include personal data, business secrets, or regulated information.
That’s why Sovereign Cloud is increasingly discussed as the foundation for “sovereign AI”. AI usage under stricter regional control and governance.
Large providers are reacting. Microsoft, for example, announced an expansion of its “Microsoft Sovereign Cloud” approach for European organizations, explicitly framed around control, compliance, and the ability to choose different deployment models.
Why Sovereign Cloud helps here:
you can define where AI data is processed and where it isn’t
you get stronger controls around privileged access and key management (depending on architecture)
you reduce the risk of having to “roll back” AI projects later because compliance was an afterthought
Sovereignty becomes a business topic the moment trust has a price tag.
IBM’s “Cost of a Data Breach Report 2024” reported average breach costs in Germany of €4.9 million per incident.
Numbers aside: As cloud becomes your core operating platform, you need to demonstrate you’re in control. Not “we think,” but “here are the controls, evidence, and governance.”
Why Sovereign Cloud helps here: In the best cases, sovereign-focused offerings come with more explicit operating models, more transparency, and better evidence for audits and customer assurance exactly what trust conversations require.
Three waves are hitting at once:
More cloud adoption: In 2023, 45.2% of EU enterprises purchased cloud computing services.
More regulation: NIS2, DORA, the Data Act (switching) are raising expectations for security and governance.
More risk: cyberattacks, supply-chain exposure, geopolitical uncertainty and AI as an accelerator.
The result: Sovereignty is moving from a “public sector special case” to a mainstream requirement for many industries, especially for critical workloads.
To keep this actionable, here are the most common patterns you’ll see:
You use public cloud, but add controls around data residency, privileged access, encryption keys, logging, and governance. Microsoft’s “Sovereign Cloud” positioning is an example of this broader approach across different environments.
AWS is a current example in Europe. In January 2026, multiple German IT outlets reported that AWS launched/started its European Sovereign Cloud in Brandenburg, positioned as physically/logically separated and aimed at regulated industries.
The typical strengths here are clear EU jurisdiction and regional operations. Trade-offs can include a smaller managed-services portfolio or a different ecosystem footprint depending on the provider and your needs.
There’s no “one best option.” The right model depends on workload criticality, regulatory pressure, risk profile, and how strong your evidence requirements are.
Instead of debating “Sovereign Cloud: yes/no,” use a simple sequence:
Cluster your workloads: Which apps/data are regulated, critical, or reputation-sensitive?
Map access reality: Who can technically access what (including support/operator paths)?
Assess legal exposure: Where is your provider legally based, and what does that imply for disclosure/access risk?
Define your key strategy: Who controls keys, how are rotation and recovery handled?
Build your audit story: What evidence do you need routinely and can you produce it?
Plan your exit: Regardless of regulation, how do you actually switch if you must?
If multiple answers are “unclear” or “depends on the provider,” you’re already in the exact problem space sovereign strategies aim to address.
GDPR was the entry point. But today the momentum is driven by cybersecurity (NIS2), operational resilience (DORA), competition and lock-in pressure (Data Act), plus a very real strategic question:
How dependent are we and can we control and prove it?
That’s why Sovereign Cloud is increasingly treated as a default target state for critical workloads: more control, more evidence, fewer blind spots.
Sovereign Cloud isn’t about ideology. It’s about control, evidence, and resilience. If your cloud strategy supports critical workloads, now is the time to validate your sovereignty posture.
Let’s make it actionable: Message me and I’ll send you a 10–15 question Sovereign Cloud checklist to stress-test your current setup.
