Digital sovereignty: what it actually means

What sovereignty is, and what it is not

Sovereignty at its core means control: the right and the ability to decide what happens, without someone else deciding it over your head. In political theory that is about a country. Digital sovereignty is the same idea applied to your information estate.

For an organisation it breaks into three questions, and it pays to ask them separately:

• Who can reach your data? Not only who is allowed to, but who technically and legally can, including without you noticing.
• Who decides whether your technology keeps working? A licence not renewed, a service discontinued, a price that doubles: all of those are someone else's decisions that land on your operation.
• Can you leave? And not in theory. Can you demonstrate it, within a timeframe you would survive.

What it is not: self-sufficiency. Building and running everything yourself is a sensible choice for almost no organisation, and it does not produce sovereignty either — it just moves the dependency onto the two people who understand it. Sovereignty is not about outsourcing less. It is about outsourcing with the exit in view.

Why a European data centre is not enough

This is where most conversations get stuck, and it is the point that matters.

The US CLOUD Act of 2018 establishes that US authorities can require a provider under US jurisdiction to produce data in its possession, custody or control — regardless of the country the data physically sits in. The law attaches to control over the data, not to its location. A European data centre owned by a US parent does not, on its own, change that.

On top of that sits the European side. The Court of Justice struck down Privacy Shield in the Schrems II case in 2020; since 2023 there is a new adequacy decision for transfers to the United States. That decision makes transfers workable, but it does not answer the jurisdiction question: it governs the conditions under which data may cross the border, not who abroad can lay claim to it.

The large providers now have answers to this, in the shape of variants with a European legal entity, European staff and operations that do not leave the continent. Those are not empty — they genuinely move control — but they are not free, not available everywhere, and the exact terms differ per provider and per service. Read them, and have a lawyer look at them before you build on them. We are an IT company, not a law firm; we can show you where the technology sits and what is movable, not what a court will make of it.

The three layers where the dependency sits

In practice it helps to look at sovereignty per layer, because the cost and the options differ enormously between them.

• The data. Where it sits, who holds the keys it is encrypted with, and where the backups are. This is the cheapest layer to act on and usually the most important.
• The technology. Does your application run on something that also runs elsewhere, or on a service that exists in one place only? A database in a container moves. A service that exists at one provider only does not move — you rebuild it.
• The operation. Who logs in to administer it, from which country, and under which law does that party fall. This layer is forgotten most often and is the first to matter during an incident.

The three do not travel together. Your data can sit in Europe while administration happens from another continent, and you can have a fully European provider running software you will never get away from. Treat sovereignty as a single tick box and you will tick the layer that was easiest to arrange.

What the rules actually say

A lot of legislation gets cited to justify sovereignty requirements. This is what it says, and where it stops.

The GDPR sets conditions on transfers outside the European Economic Area and on what you agree with processors. It does not require a European provider; it requires you to be able to explain where data goes and on what basis.

NIS2, worked out in the Netherlands as the Cyberbeveiligingswet, asks for supply chain risk management and puts the responsibility explicitly on the board. That is not a sovereignty requirement either, but it does force you to write down which supplier brings which risk — and that is exactly the inventory this subject starts with.

DORA has applied to financial entities since January 2025 and goes furthest: they must hold an exit strategy for critical ICT providers and weigh concentration risk explicitly. It is currently the closest legal equivalent of what this article is about.

The European Data Act has applied since September 2025 and obliges providers to make switching possible rather than contractually awkward; the charges they may levy for it are to be phased out. For this subject that is the most useful development of recent years.

A European certification scheme for cloud has been in the works for years, and the level at which sovereignty requirements would apply is precisely the part it keeps stalling on. Do not count on it being there at the moment you have to choose.

What to do about it, practically

Here is a ladder, cheap to expensive. Most organisations get no further than the first three rungs, and that is usually exactly enough.

• Write down where everything sits. Which service, which provider, which country, under which law, and what stops if it disappears. This costs an afternoon and it is the one step you need regardless — for NIS2, for your insurer and for yourself.
• Put your backups somewhere else. With a different provider, in a different jurisdiction, written immutably. This is the rung with the highest return per euro: it protects against a provider going away, against ransomware and against an unpaid invoice. How we set that up sits under data and business continuity.
• Hold your own keys where you can. Encryption with keys you keep limits what a provider can produce when asked. Know what you are buying, though: with many services the key has to enter the provider's memory to be usable, and at that point the protection is procedural rather than mathematical.
• Test the exit. An exit plan that has never been executed is a document, not a plan. Once a year, restore an environment at a different party and measure how long it took. Almost nobody does this, and almost everybody who does runs into something.
• Move what is movable. Only here do sovereign variants, European providers or your own hardware come into view — once the first four rungs are in place and the trade-off still points that way.

The reverse question belongs here too: when does this not apply. If you process no special category personal data, fall under neither NIS2 nor DORA and have no customers demanding it, the first rung is enough and the other four are money that earns more elsewhere. We say that too, even when it would cost us the work.