What is data sovereignty, and why does it matter for your data?

What does data sovereignty mean?

Data sovereignty is the principle that data falls under the laws and control of a chosen jurisdiction, in practice the EU for European organisations. It goes further than knowing which country your data centre is in.

Imagine your board asks three questions: where is our customer data, which governments could demand it, and could we still operate if our main cloud provider became unavailable or untrustworthy? Data sovereignty is the set of answers. It also sits squarely inside NIS2 risk management, which we cover on our NIS2 compliance page.

In short: residency is about geography, sovereignty is about jurisdiction and control.

Why does the US CLOUD Act matter for data stored in the EU?

Because it follows the provider, not the data centre. The CLOUD Act lets US authorities require US providers to hand over data they control, even if it's stored in the EU.

The key provision, 18 U.S.C. § 2713, added in March 2018, requires a provider to disclose data "within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." The US Department of Justice's CLOUD Act resources also list executive agreements with the UK and Australia, and EU–US negotiations that resumed in March 2023.

US providers have responded with EU-based offerings. Microsoft's EU Data Boundary, for example, commits to storing and processing Microsoft 365 and Azure customer data in the EU and EFTA, with limited documented exceptions. That improves residency. It doesn't change who owns the provider. When a French Senate inquiry asked Microsoft France's Anton Carniaux in June 2025 whether he could guarantee French data would not be passed to US authorities without French approval, he answered "No, I cannot guarantee that," adding that it had never happened, according to The Register.

EU law pushes back. Article 48 GDPR says a third-country court judgment or authority decision requiring a transfer of personal data "may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty." A provider can end up caught between the two.

Is the EU–US Data Privacy Framework enough?

It's a valid legal basis for transferring personal data to certified US companies today, but it's under appeal and it doesn't remove US law enforcement access under the CLOUD Act.

The European Commission adopted its adequacy decision for the EU–US Data Privacy Framework in July 2023. On 3 September 2025 the EU General Court dismissed a challenge by French MP Philippe Latombe, IAPP reported, noting it's the third EU–US transfer framework reviewed by EU courts in a decade, after Safe Harbor (struck down in 2015) and Privacy Shield (2020). Latombe appealed to the Court of Justice on 31 October 2025, and the case is pending, according to WilmerHale.

For risk planning, that history matters more than any single ruling. If your recovery depends entirely on a transfer mechanism that has been overturned twice before, you carry legal as well as technical risk.

How does the European Commission define cloud sovereignty?

Through its Cloud Sovereignty Framework, a procurement scoring model published in October 2025. It's written for the Commission's own cloud tenders, but it's a useful checklist for anyone.

The Cloud Sovereignty Framework (version 1.2.1) assesses providers on eight objectives:

1. Strategic sovereignty
2. Legal and jurisdictional sovereignty
3. Data and AI sovereignty
4. Operational sovereignty
5. Supply chain sovereignty
6. Technology sovereignty
7. Security and compliance sovereignty
8. Environmental sustainability

Each is scored on a SEAL scale from SEAL-0, "no sovereignty", where services are under exclusive control of non-EU parties, up to SEAL-4, "full digital sovereignty", with technology and operations "under complete EU control, subject only to EU law". The takeaway for an SME or MSP: ask suppliers about ownership, jurisdiction and operational control, not only about data centre location.

What does data sovereignty mean for backup and NIS2?

Your backup is your fallback when the primary platform fails, is compromised or becomes legally complicated. Keeping it with an independent EU provider gives you a second supplier and a second jurisdiction for recovery.

Both laws point the same way. NIS2 Article 21(2)(c) requires "business continuity, such as backup management and disaster recovery, and crisis management", and Article 21(2)(d) requires supply chain security, including the risks of your direct suppliers. Under the GDPR, a backup provider is a processor, so Article 28 requires a contract with it, and Article 32(1)(c) requires "the ability to restore the availability and access to personal data in a timely manner."

A GDPR-compliant backup, in practical terms, has:

• A Data Processing Agreement under Article 28 GDPR.
• Storage in the EU, with a provider that doesn't rely on third-country transfers for the backup data.
• Encryption in transit and access controls with MFA.
• Tested restores, so "timely" is a number you can show.

This is how we built our backup service. Data is stored only in our own Tier III data centres in the Netherlands and Germany, under EU law and independent of US hyperscalers. Every contract includes a GDPR Data Processing Agreement, and we're ISO 27001 and NEN 7510 audited. If your production data lives in Azure, see Azure backup, and for the difference between the two kinds of copy, read cloud storage vs cloud backup.

How do you improve data sovereignty without leaving your cloud?

Start with your recovery copy and your supplier list. You don't need to migrate away from Microsoft 365, Google Workspace or a public cloud to make real progress.

1. Map data and suppliers. List where critical data lives and who owns each provider, including parent companies outside the EU.
2. Classify. Decide which data is sensitive enough that foreign access or supplier lock-in is unacceptable.
3. Check contracts. Confirm Data Processing Agreements, sub-processors and the transfer mechanism each one relies on.
4. Add a sovereign recovery copy. Back up critical workloads to an EU provider, with immutable storage and separate credentials.
5. Plan your exit. Know how you'd restore data outside the primary platform, and test it once a year.
6. Report to management. Under NIS2 Article 20, management bodies approve and oversee cybersecurity measures, so put sovereignty risk on the agenda.

Not sure whether NIS2 applies to you? Check who falls within NIS2 scope. For supplier assessments, see NIS2 supply chain security.

What to do next

Data sovereignty isn't a label on a data centre. It's knowing which laws reach your data, keeping control of access, and being able to recover without depending on a single foreign supplier. For most organisations the fastest win is an independent, EU-based backup of the systems they can't run without.

Read how sovereignty fits your wider obligations on our NIS2 compliance page, or request a free assessment of where your data and backups sit today.

This article is information, not legal advice.