Whose Cloud Is It Anyway? Navigating Data Sovereignty In Europe

Data sovereignty is becoming an important consideration in the regulation of digital services, and extends beyond where personal data is stored or processed to encompass cloud infrastructure, access to critical technologies, foreign governmental access, supply chain dependencies and the extent to which organisations retain effective control over their data and the services on which they rely.

Key Takeaways

• The European Commission is developing a more structured approach to cloud sovereignty. Its Cloud Sovereignty Framework has been applied in a major EU institutional procurement exercise, with four providers awarded contracts worth up to EUR 180 million over six years. Separately, the proposed Cloud and AI Development Act would establish four EU-wide Union Assurance Levels for cloud services supplied to public sector bodies.
• Member States continue to pursue their own paths. France has placed trusted-cloud requirements on a statutory footing for specified sensitive state data, with SecNumCloud 3.2 approved as the applicable requirements framework in August 2026. Germany has developed complementary approaches through the BSI's C5 security assurance framework and its newer C3A criteria for cloud autonomy.
• The UK is taking a different approach. Its emphasis is on resilience, risk management, supplier diversity and domestic technological capability, including through the National Cloud Infrastructure Programme, rather than any general requirement to store or process data in the UK.
• Sovereignty is assessed by reference to control, rather than location alone. A provider’s governing jurisdiction, ownership and control arrangements, access to encryption keys, operational dependencies and exposure to third-country laws are becoming as relevant as the location of its data centres.

For multinational businesses, the challenge is not simply to identify where data is held, but to understand who controls the infrastructure and services through which it is processed, which laws may affect access to it and what contractual and technical assurances are available.

A Note On Terminology

Data residency and data sovereignty are distinct concepts. Data residency concerns where information is stored or processed. Data sovereignty is broader, encompassing the legal, corporate, operational and technological arrangements through which data and supporting services are controlled. Relevant considerations include:

• Legal and jurisdictional control: whether the provider or its affiliates may be subject to laws requiring disclosure of information to foreign authorities.
• Operational control: who can administer infrastructure, access systems, manage encryption keys or provide technical support.
• Corporate ownership: whether the provider is owned or controlled by entities established outside the relevant jurisdiction.
• Technological dependencies: whether the service relies on software, hardware or other components controlled by third parties.
• Supply chain resilience: whether disruption or withdrawal by a third party could materially affect the availability or continued operation of the service.

The distinction matters when assessing cloud arrangements, because hosting data in the EU may satisfy a residency requirement without eliminating exposure to foreign laws or operational dependencies. Equally, foreign ownership does not automatically make a cloud service unsuitable or unlawful. The relevant question is whether the provider’s corporate and operational arrangements, together with appropriate technical and contractual safeguards, provide sufficient control for the service and data concerned.

The Legacy EU Framework

Member States may not restrict the free movement of personal data within the Union on data protection grounds, and Regulation (EU) 2018/1807 extends the same principle to non-personal data. But data sovereignty raises a different question: not whether data can move, but who controls it wherever it is held.

For personal data, Chapter V of the GDPR regulates transfers to third countries, Article 48 provides that a third-country judgment or administrative decision requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable where based on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer under Chapter V GDPR. However, these rules do not address the broader questions of infrastructure ownership, operational control and technological dependency that are central to digital sovereignty.

For non-personal data, the starting point is Article 4 of Regulation (EU) 2018/1807, which prohibits Member State data localisation requirements unless justified on grounds of public security, and without prejudice to localisation requirements under existing EU law. Member States therefore cannot generally pursue sovereignty by requiring non-personal data to remain within their territory. (The Commission's Digital Omnibus proposal would repeal Regulation (EU) 2018/1807 and incorporate its provisions on free flow of data into the Data Act. The proposal remains subject to the EU legislative process, so the existing Regulation continues to apply).

More recently, Article 32 of the Data Act now requires providers of data processing services to take all adequate technical, organisational and legal measures, including contractual measures, to prevent international and third-country governmental access to, and transfers of, non-personal data held in the Union where these would conflict with EU or Member State law. Additionally, Article 31 of the Data Governance Act imposes an equivalent obligation to take all reasonable measures on a narrower group — namely, public sector bodies, re-users of protected public sector data, data intermediation services providers and recognised data altruism organisations.

The Evolving EU Framework

Recent initiatives have been driven in part by concerns about Europe’s reliance on a relatively small number of non-European providers for critical digital services. Those concerns extend beyond exposure to third-country laws — including the U.S. CLOUD Act — to the risk of operational disruption and the limited availability of alternative technologies and suppliers. Against that backdrop, the European Commission is not proposing a general requirement to use European-owned providers or host all data within the EU, but rather is developing a tiered approach under which the level of sovereignty required can be assessed by reference to the service, sector and intended use.

The Cloud Sovereignty Framework

In October 2025, the Commission launched a procurement exercise under its Cloud III Dynamic Purchasing System, using its newly developed Cloud Sovereignty Framework to assess providers of sovereign cloud services for EU institutions, bodies, offices and agencies. The procurement was worth up to EUR 180 million over six years.

The framework assesses services against eight sovereignty objectives, covering strategic, legal and jurisdictional, data and AI, operational, supply chain, technological, security and compliance, and environmental considerations. These objectives are assessed through a combination of a Global Sovereignty Score, based on 48 criteria, and Sovereignty Effectiveness Assurance Levels (SEALs), ranging from SEAL-0 to SEAL-4. The higher levels indicate progressively greater sovereignty and resilience, with SEAL-2 representing data sovereignty, SEAL-3 technological autonomy and SEAL-4 full sovereignty.

In April 2026, the Commission awarded contracts under the procurement to four providers. The tender required providers to achieve at least SEAL-2, while three of the successful providers achieved SEAL-3. The successful procurement was intended not only to provide cloud services to EU institutions but also to promote supplier diversification and reduce dependence on individual providers.

The framework is instructive because it does not necessarily exclude non-European technology. For example, the successful partnership led by Proximus, involving services from S3NS (a joint venture between Thales and Google Cloud), Clarence and Mistral, achieved SEAL-2. This illustrates that the relevant question is not necessarily whether every component of a cloud service is European-owned, but whether the service is operated within arrangements that provide the required level of control and resilience. e operated within arrangements that provide the required level of control and resilience.

The Cloud and AI Development Act

The Commission’s proposed Cloud and AI Development Act (CADA), adopted in June 2026 as part of its Tech Sovereignty Package, would take the Commission’s approach a stage further. Its objectives include supporting cloud and AI innovation, accelerating the deployment of data centres across the EU and promoting technological autonomy through a common sovereignty assessment framework.

The proposal would establish four EU assurance levels, intended to provide progressively greater assurance concerning infrastructure location, operational independence, ownership and control, supply chain dependencies and protection against third-country interference. The highest levels would be reserved for services where the consequences of losing control or access justify more demanding safeguards. Providers would apply to national competent authorities for recognition of a service at a particular level, while Member States would undertake sovereignty risk assessments to determine which public sector activities and use cases require different levels of assurance.

CADA remains subject to the EU’s ordinary legislative procedure and is not yet binding, so its final requirements may change. Nevertheless, it signals the Commission’s intention to move towards a common EU-wide framework, rather than leaving public authorities to develop their own sovereignty criteria.

National Approaches

There is no common national approach to data sovereignty. Member States’ requirements and expectations differ, particularly in relation to data location, provider ownership, security assurance and protection against foreign governmental access. The UK has taken its own course. As a result, a cloud architecture that is acceptable in one jurisdiction may not satisfy the requirements of a public authority or regulated customer in another.

France

France has adopted one of the more developed approaches to cloud sovereignty. Its SecNumCloud qualification framework, administered by the National Cybersecurity Agency (ANSSI), establishes security and other requirements for cloud providers. Version 3.2 addresses exposure to non-European laws, including through requirements concerning provider establishment, capital and decision-making arrangements.

In addition, Article 31 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space (the SREN Law) requires state administrations, state operators and certain public interest groupings using private cloud services to process particularly sensitive data to ensure that those services protect the data against access by third-country public authorities not authorised under EU or Member State law where a breach of those data is capable of causing certain specified harms. The provision covers personal and non-personal data, and its implementation is supported by regulations approving SecNumCloud Version 3.2 as the applicable requirements framework. Temporary derogations are available in limited circumstances, including for certain projects already under way where an acceptable alternative service is not available.

The French approach shows why data location alone is not sufficient protection against foreign governmental access. Hosting data in France or elsewhere in the EU does not necessarily remove the risk where the provider remains subject to foreign jurisdiction or dependent on entities outside the EU. That said, the statutory requirements are limited to specified public sector bodies processing particularly sensitive data and do not establish a general obligation on private sector organisations to use SecNumCloud-qualified providers. Qualification is nonetheless becoming an important commercial differentiator for suppliers to the French public sector.

Germany

Germany has developed a more structured approach to cloud security and sovereignty through two complementary BSI frameworks: the Cloud Computing Compliance Criteria Catalogue (C5) and the Criteria enabling Cloud Computing Autonomy (C3A).

C5 provides a framework for assessing cloud providers’ security and operational controls. It operates as an attestation scheme rather than a formal certification procedure, with an independent auditor examining the provider’s controls under ISAE 3000 or a recognised national equivalent. C5 attestation is therefore useful evidence of security controls, but does not establish that a provider offers sovereign control. A provider may demonstrate a high level of security compliance while remaining subject to foreign jurisdiction or dependent on non-European infrastructure and technology.

The BSI’s publication of C3A on 27 April 2026 addresses this gap. C3A provides a framework for assessing whether a cloud service can be used autonomously and in a self-determined manner, having regard to the customer’s particular risk context. C3A assumes that the provider satisfies the applicable C5 criteria, while extending the assessment to the broader question of sovereignty. Importantly, C3A is not a binding regulatory framework. It is intended to provide transparency and enable cloud customers to identify and specify the sovereignty requirements appropriate to their use cases. Providers may demonstrate compliance through an audit, while customers can select the relevant criteria and additional criteria according to their requirements. The framework also allows customers to distinguish between EU and German localisation requirements, depending on the criticality of the relevant service and the outcome of their risk assessment.

C3A moves the German approach beyond security assurance towards a more comprehensive assessment of cloud sovereignty. It also reflects the structure and objectives of the Commission’s Cloud Sovereignty Framework, while incorporating additional criteria. Germany is therefore developing an approach that is more closely aligned with the emerging EU framework, although C3A remains a voluntary assessment tool rather than a legal requirement.

United Kingdom

The UK has generally approached digital sovereignty through resilience, security, technological capability and the management of dependencies, rather than broad data localisation requirements. Guidance published by the Government Digital Service in February 2025 recognises that organisations may need to use cloud and software-as-a-service (SaaS) solutions located outside the UK to support resilience, capacity and access to innovation. However, the guidance is limited to public cloud and SaaS, and does not cover an organisation’s own or managed data centres, or infrastructure-as-a-service and platform-as-a-service offerings outside a public cloud setting.

Alongside this more flexible approach to data location, the UK is seeking to strengthen its domestic technological capabilities, particularly in AI and computing infrastructure. Initiatives including the Modern Industrial Strategy and Digital and Technologies Sector Plan (2025), the AI Opportunities Action Plan and a National Cloud Infrastructure Programme are intended to reduce strategic dependencies and develop domestic capability, rather than require data or AI workloads to remain in the UK. Lastly, the Government's Cloud Challenge Book 2026 identifies a number of challenges for the UK cloud market, including the need for more resilient domestic cloud infrastructure, improved regional capability, secure-by-default services and reduced dependence on single regions or providers. 

Implications For Businesses

For multinational organisations, particularly those operating in financial services, life sciences, healthcare and critical infrastructure, four issues merit particular attention.

1. Identify where sovereignty requirements apply. Organisations should distinguish binding legal obligations from policy objectives and commercial expectations. For example, a specific procurement requirement, such as the French statutory requirements for sensitive state data, may be decisive for a government supplier without applying to its commercial customers.
2. Review cloud and technology dependencies. Organisations should understand not only where their data is stored, but also which entities can access or control the relevant systems. This includes dependencies arising through subcontracting, remote administration, technical support and third-country infrastructure. The assessment should extend beyond the immediate cloud provider to the wider supply chain.
3. Assess contractual protections. Cloud and outsourcing contracts should address data location, notification of changes to service arrangements, subcontracting, access controls, encryption keys and the handling of governmental access requests. For EU customers, the obligations imposed on providers under Article 32 of the Data Act are particularly relevant. Contractual assurances should, however, be assessed alongside the provider’s technical and operational arrangements.
4. Monitor the development of EU-wide requirements. Although neither the Cloud Sovereignty Framework nor CADA imposes general requirements on private sector organisations, both are likely to influence the criteria applied by public authorities and customers when selecting cloud providers. Providers that can demonstrate recognised levels of sovereignty assurance may therefore gain a commercial advantage, particularly when competing for public sector contracts or supplying customers with demanding security and resilience requirements.

Looking Ahead

There is no single model of data sovereignty emerging across Europe and the UK. The EU is moving towards a more structured approach, emphasising technological autonomy, control over critical infrastructure and reduced strategic dependencies, while Member States retain distinct approaches. For its part, the UK favours a more flexible model centred on control and assurance, resilience, supplier diversity and domestic technological capability, without imposing any general data localisation requirement.

For businesses operating across the EU and UK, these differences make it important to understand who controls their data, which laws may affect access to it and how their dependencies on third-party technology providers are managed. Identifying where data is stored remains important, but it is no longer sufficient on its own. As a result, data sovereignty is becoming a question of whether the arrangements surrounding the storage and processing of data provide sufficient legal, operational and technological control.

Subscribe to Ropes & Gray Viewpoints by topic here.