Achieving Enterprise Data Sovereignty in 2025

Introduction

The concentration of western data in United States-controlled infrastructure has emerged as one of the most pressing challenges facing European and global enterprises in 2025. With approximately 92 percent of western data stored on US-owned clouds and infrastructure, businesses across Europe, Canada, Australia, and other western democracies face a stark reality: their most valuable digital assets remain subject to foreign jurisdiction, extraterritorial surveillance laws, and geopolitical uncertainties that threaten operational autonomy. This dependency extends far beyond mere technical considerations. American tech giants Amazon Web Services, Microsoft Azure, and Google Cloud control roughly 70 percent of Europe’s cloud infrastructure, creating what French officials have characterized as a form of digital dependency akin to addiction. In Belgium, Microsoft commands 70 percent of cloud infrastructure market share. Sweden has entrusted over 57 percent of its public digital infrastructure, including cities and government services, to Microsoft mail servers. Similar patterns emerge across Finland (77 percent), the Netherlands (60 percent), and Norway (64 percent).

The challenge intensifies when examining the legal landscape. The United States CLOUD Act, enacted in 2018, grants American federal law enforcement agencies authority to compel US-based technology companies to provide requested data stored anywhere globally, regardless of physical location. This extraterritorial reach directly conflicts with European data protection principles enshrined in the General Data Protection Regulation. Similarly, the Foreign Intelligence Surveillance Act Section 702 authorizes warrantless collection of foreign communications by US intelligence agencies, targeting non-US persons located outside American territory for national security purposes.

Understanding the Sovereignty Gap

Data sovereignty fundamentally represents the principle that digital information remains subject to the laws and governance structures of the jurisdiction where it originates or resides. For western businesses operating under increasingly stringent privacy regulations, this concept has evolved from theoretical concern to operational imperative. The European Union alone has implemented a comprehensive regulatory framework encompassing the Data Act, Data Governance Act, Digital Operational Resilience Act, and GDPR, collectively designed to safeguard European citizens’ data rights while promoting digital autonomy. The current dependency on American cloud infrastructure creates multiple vulnerability vectors. Even when data physically resides within European data centers, organizations utilizing US-based providers remain exposed to American legal jurisdiction. US courts can issue production orders requiring disclosure of customer data held by American companies, irrespective of storage location. Under the CLOUD Act, these production orders apply to any data within a cloud provider’s control, while FISA Section 702 enables the National Security Agency to issue directives compelling US cloud providers’ parent companies to disclose customer data stored in Europe. This jurisdictional complexity extends beyond government surveillance concerns. Organizations face compliance challenges when American laws conflict with European regulations. The Court of Justice of the European Union’s landmark Schrems II decision invalidated the EU-US Privacy Shield framework, declaring that FISA Section 702’s lack of judicial oversight and inadequate redress mechanisms for EU citizens make US privacy protections insufficient under GDPR standards. While the EU-US Data Privacy Framework attempts to address these concerns through binding safeguards limiting US intelligence authorities’ data access, legal challenges persist, with the possibility of additional court cases continuing to create uncertainty

European Sovereign Cloud Infrastructure

Europe has responded to these challenges through coordinated initiatives designed to reclaim digital autonomy. The Gaia-X project, launched in 2019 by German Minister of Economic Affairs Peter Altmaier and French counterpart Bruno Le Maire, represents the most ambitious attempt to develop a federated secure data infrastructure for Europe. Rather than creating a competing cloud service provider, Gaia-X aims to establish standards, rules, and verification frameworks enabling transparent data exchange while maintaining European sovereignty principles.​ The initiative has progressed substantially since its inception. Participants now access a comprehensive trust framework defining secure data exchange protocols between different services. The Loire release, presented at the official Gaia-X Summit, provides businesses with technical tools implementing Gaia-X standards through automated compliance with regulatory requirements. Multiple lighthouse projects test Gaia-X technology across industries including agriculture, automotive, and energy sectors. Since 2021, over 200 million euros in funding has supported these projects, with the initiative expanding beyond European borders to include pilots in Japan and Korea. Complementing Gaia-X, Europe has witnessed emergence of truly sovereign cloud providers headquartered and operated entirely within European Union jurisdiction. OVHcloud from France, Scaleway from France, T-Systems from Germany, Hetzner from Germany, UpCloud from Finland, and Exoscale from Switzerland and Austria exemplify this model. These providers offer mature Infrastructure-as-a-Service and increasingly capable Platform-as-a-Service solutions, with their primary advantage residing in enhanced data control, clearer regulatory pathways, and predictable long-term operating conditions. Unlike American hyperscalers establishing European subsidiaries, these organizations maintain no operational ties to United States jurisdiction, creating formidable barriers against foreign data access requests. The European Commission has formalized sovereignty assessment through its Cloud Sovereignty Framework, which evaluates cloud services across eight objectives spanning strategic alignment, legal jurisdiction, operational sovereignty, supply chain transparency, technological openness, security, compliance with EU law, and environmental sustainability. Services receive SEAL rankings from zero (no sovereignty) to four (full digital sovereignty), with the framework explicitly designed for government procurement decisions. A 180 million euro tender launched in 2025 selects up to four providers meeting minimum levels across all eight objectives, with any offer failing criterion thresholds automatically rejected.

Strategic Pathways to Data Sovereignty

• Western businesses pursuing data sovereignty must navigate complex technical and organizational transitions. The most effective approach combines multiple strategies tailored to specific workload characteristics, regulatory requirements, and operational constraints. Hybrid Cloud Architectures represent the pragmatic middle ground, enabling organizations to maintain sensitive data within sovereign environments while leveraging public cloud capabilities for less critical workloads. This model involves building private on-premises environments securing highly sensitive data while benefiting from hyper-scaler advanced technology for appropriate use cases. Private clouds and edge computing can satisfy requirements for data protection, geographical localization, control, access, and security. By nature, private clouds located within national borders and dedicated to specific customers provide core building blocks required for cloud sovereignty, since workloads and data fall under domestic jurisdiction while remaining fully disconnected from hyperscalers. However, hybrid approaches require careful workload classification. Organizations must determine which data can remain on public cloud infrastructure versus which data must migrate to on-premises environments. This decision framework typically considers data sensitivity classifications, regulatory compliance requirements, performance characteristics, and cost implications. Studies indicate that 19 percent of companies plan to increase on-premises investments, while 13 percent have slowed or completely stopped cloud migrations, driven primarily by control requirements rather than cost considerations.
• Multi-Cloud Strategies distribute workloads across multiple cloud providers, reducing single-vendor dependency while optimizing for specific regional sovereignty requirements. According to 2024 research, over 92 percent of large enterprises now operate in multi-cloud environments, leveraging services from AWS, Microsoft Azure, Google Cloud Platform, and regional providers based on geographical compliance needs. This approach allows sensitive data deployment on European sovereign cloud infrastructure while utilizing hyperscaler services for global-facing applications or compute-intensive workloads. The multi-cloud model addresses data sovereignty by enabling organizations to select providers with data centers in specific regions meeting local legal requirements. For example, enterprises might utilize OVHcloud or Scaleway for European Union citizen data requiring GDPR compliance, AWS for United States operations, and regional providers for Asia-Pacific markets. However, multi-cloud architectures introduce complexity requiring sophisticated orchestration tools like Kubernetes, Terraform, and Ansible managing deployments across environments, alongside unified monitoring solutions providing insights into application performance.
• Encryption Key Management emerges as perhaps the most critical technical control for organizations unable to fully repatriate from US cloud providers. Effective key management ensures that even if cloud providers face legal compulsion to provide access, encrypted data remains protected without customer-controlled decryption keys. Solutions like Microsoft Purview Double Key Encryption employ two separate encryption keys, one controlled by Microsoft and one exclusively controlled by the customer, where data can only be decrypted when both keys combine. Critically, all encryption and decryption occurs locally on client devices before data transmission to Microsoft’s cloud, ensuring only encrypted versions ever leave customer environments. Advanced key management implementations incorporate Bring Your Own Key or Hold Your Own Key models empowering enterprise data sovereignty in cloud-hosted environments. These approaches enable organizations to maintain encryption keys within specific geographic locations ensuring adherence to data sovereignty laws, with geo-fencing capabilities preventing key access from unauthorized jurisdictions. The most sophisticated solutions employ secure Multi-Party Computation for key distribution mitigating single points of compromise, while offering deployment flexibility across on-premises, Software-as-a-Service, or hybrid models.
• Cloud Repatriation has accelerated dramatically, with 83 percent of enterprises planning to repatriate workloads from public to private or on-premises environments in 2024, compared to just 43 percent in 2021. This trend reflects converging factors including exploding AI-driven costs, hybrid cloud infrastructure maturation, and evolving sovereignty regulations. Organizations cite security and compliance hurdles as primary motivations, with 51 percent of decision makers identifying security issues as the dominant reason for repatriation. Data sovereignty requirements specifically drive repatriation decisions, as expanding global regulations govern data location. Sensitive information including personally identifiable information, medical records, and financial records must remain physically stored within specific geographic boundaries. Repatriation enables businesses to align with local mandates while maintaining compliance more effectively than complex multi-jurisdictional cloud arrangements. Rather than wholesale cloud abandonment, repatriation typically involves strategic migration of specific workloads, with organizations maintaining cloud-based services where they deliver clear value while bringing sovereignty-sensitive workloads back under direct control.
• Low-Code and Open-Source Platforms provide compelling sovereignty enablers by democratizing development capabilities and reducing dependence on foreign enterprise software vendors. Low-code platforms like Corteza allow organizations to build custom enterprise applications resembling Salesforce, Microsoft Dynamics, SAP, and Oracle NetSuite without proprietary licensing restrictions. These platforms accelerate development by 60 to 80 percent while preserving sovereignty through internal solution development addressing specific business needs while maintaining data control and operational autonomy. Open-source enterprise resource systems including Odoo, ERPNext, Dolibarr, and Apache OFBiz offer European alternatives to American proprietary software. These solutions provide full transparency, control, and flexibility without hidden costs or forced updates. Organizations decide how technology operates and where it deploys, rather than accepting terms dictated by foreign corporations. European open-source initiatives like openDesk from Zentrum Digitale Souveränität demonstrate that Europe can build robust digital ecosystems with tools including XWiki, CryptPad, OpenProject, and Nextcloud serving as privacy-oriented alternatives to platforms outside Europe.
• Edge Computing addresses data sovereignty by processing and storing information closer to its origin rather than centralized data facilities, helping maintain data within national borders subject to local laws. Edge computing reduces risks associated with cross-border data transfers while providing advantages including reduced latency, improved network efficiency, and superior real-time data processing capabilities. For industries requiring low-latency applications or facing stringent data localization requirements, edge architectures enable compliance while maintaining operational performance.

Navigating Regulatory Complexity

Western businesses must align data sovereignty strategies with evolving regulatory frameworks spanning multiple jurisdictions. The European Union’s comprehensive approach encompasses GDPR governing personal data processing, the Network and Information Systems Directive 2 (NIS2) enhancing cybersecurity across essential sectors, and the Digital Operational Resilience Act (DORA) ensuring financial entities can withstand ICT-related disruptions. These regulations exhibit notable intersections, particularly regarding risk management, incident reporting, and security emphasis. Risk management strategies advocated by NIS2 and operational resilience requirements of DORA complement each other, while GDPR’s data protection by design and default requirements support cybersecurity measures outlined in NIS2. Organizations implementing unified compliance platforms can address multiple regulatory requirements simultaneously, eliminating gaps created by fragmented systems failing to communicate effectively. The 144 countries worldwide that have enacted data protection and sovereignty laws create additional complexity for multinational organizations. Each jurisdiction maintains unique requirements regarding data residency, cross-border transfers, encryption standards, and governmental access provisions. Western businesses must conduct comprehensive Transfer Impact Assessments when moving data internationally, often implementing supplementary measures including strong encryption with keys controlled within appropriate jurisdictions.

Building Organizational Capabilities

Achieving data sovereignty requires more than technology deployment. Organizations must develop comprehensive governance frameworks, cultivate internal expertise, and foster cultural shifts recognizing data sovereignty as strategic imperative rather than compliance burden. Successful implementations begin with thorough data classification systems identifying which information requires sovereign treatment based on sensitivity levels, regulatory obligations, and business criticality. This classification drives decisions regarding appropriate storage locations, encryption requirements, access controls, and retention policies. Organizations should establish clear data lineage tracking, documenting where information originates, how it flows through systems, where it resides, and who accesses it throughout lifecycle stages. Vendor selection processes must incorporate sovereignty considerations as primary evaluation criteria. Organizations should assess potential providers across multiple dimensions including legal jurisdiction and ownership structure, operational control and personnel nationality, data center locations and residency guarantees, encryption and key management approaches, contractual commitments regarding data access, audit rights and transparency provisions, and exit strategies preventing vendor lock-in. For truly sovereignty-sensitive workloads, preference should favor providers headquartered within appropriate jurisdictions without subsidiaries or dependencies exposing them to foreign legal requirements. Training and awareness programs ensure personnel understand sovereignty requirements and their individual responsibilities. This extends beyond technical teams to encompass business units, procurement departments, legal counsel, and executive leadership. Organizations should develop clear policies governing data handling, establish approval workflows for cloud service adoption, and implement monitoring mechanisms detecting shadow IT introducing sovereignty risks.

Looking to the Future

Western businesses confronting the reality that 92 percent of their data resides on US-owned infrastructure face complex but navigable challenges.

Achieving genuine data sovereignty requires strategic commitment extending beyond superficial measures. Organizations cannot rely solely on American hyperscalers establishing European subsidiaries or sovereign cloud offerings, as fundamental jurisdictional conflicts remain unresolved despite billions in infrastructure investment. The path forward demands pragmatic, multi-layered approaches combining European sovereign cloud providers for sensitive workloads, hybrid architectures maintaining critical data on-premises, robust encryption with customer-controlled key management, and strategic workload repatriation where appropriate. Success requires treating sovereignty as ongoing program rather than one-time project, with continuous assessment as regulatory landscapes evolve, technologies mature, and geopolitical dynamics shift. The sovereign cloud market demonstrates this priority’s commercial significance, with the global market valued at 123 billion USD in 2024 and projected to reach 824 billion USD by 2033. Europe leads adoption, with 84 percent of European organizations using or planning to use sovereign cloud solutions. This momentum reflects growing recognition that digital sovereignty constitutes not merely regulatory compliance but competitive advantage, customer trust differentiator, and foundation for innovation in an increasingly fragmented digital world. Western businesses possessing clarity regarding sovereignty objectives, technical capabilities for implementation, and organizational commitment required for sustained transformation can reclaim control over their digital destinies. The concentration of data in American infrastructure represents current state, not inevitable future. Through deliberate strategy, appropriate technology selection, and unwavering focus on sovereignty principles, enterprises can achieve operational autonomy while maintaining access to cloud computing’s transformative capabilities

References: