Cloud technologies have transformed the way organisations operate, enabling greater flexibility, scalability and efficiency. At the same time, they have created new dependencies. Today, business-critical data often resides in infrastructures operated by global cloud providers, while complex international regulations make it increasingly difficult to determine who can access that data – and under which legal framework.
This is why digital sovereignty has become a strategic priority for many organisations, particularly across Europe. It is no longer just about where data is stored, but about maintaining control over data, identities, access rights and digital infrastructure. As regulatory requirements continue to evolve and geopolitical uncertainty grows, organisations are reassessing how to reduce dependencies without sacrificing innovation or operational efficiency.
For many years, the rapid adoption of cloud computing and digital transformation shifted the focus away from digital sovereignty. Organisations embraced cloud services to increase flexibility, reduce costs and accelerate innovation, often outsourcing not only their IT infrastructure and software but also the management of their data.
Today, priorities are changing. Digital sovereignty is increasingly recognised as a strategic business imperative rather than a purely technical or regulatory concern. As organisations face growing geopolitical uncertainty, evolving compliance requirements and increasing dependence on global technology providers, many are reassessing how to regain greater control over their data, digital infrastructure and critical business processes.
Despite its growing importance, digital sovereignty is often misunderstood. What does it actually mean in practice? Which regulations shape it? And how can organisations strengthen their digital independence without sacrificing the benefits of cloud technologies?
According to Esther Goernemann of the Berlin-based Weizenbaum Institute, digital sovereignty is "far more than an empty buzzword". Instead, it reflects a series of technological, political and economic developments that have fundamentally changed the way organisations think about data ownership and digital resilience.
Several key developments have accelerated this shift and continue to shape today's discussion around digital sovereignty. One of the most significant has been the increasing commercialisation of digital services, which has given governments and technology providers greater influence over the infrastructure that underpins today's connected economy.
Over the past two decades, a small number of global technology companies have established dominant positions in the cloud market. While their services have accelerated digital innovation, they have also created new dependencies. For many European organisations, this concentration raises important questions about competition, resilience and long-term control over critical digital infrastructure.
Digital sovereignty is therefore not about rejecting cloud technologies. Instead, it is about reducing single-provider dependencies, increasing transparency and ensuring organisations retain control over their most valuable digital assets.
Concerns about digital sovereignty intensified in 2013 when former NSA contractor Edward Snowden revealed the scale of global surveillance programmes conducted by the US National Security Agency (NSA). The disclosures demonstrated that large volumes of digital information could become accessible not only to technology providers but also to government authorities.
The revelations also highlighted the broader implications of cyber espionage. According to Goernemann, intelligence activities increasingly intersect with economic interests, with organisations and governments seeking strategic advantages through access to sensitive information. The Snowden disclosures fundamentally changed Europe's perspective on data protection and digital independence, placing digital sovereignty firmly on the political and business agenda.
One response to these developments has been the growing focus on data localisation. More organisations are choosing to store, process and manage sensitive information within clearly defined legal jurisdictions, helping them strengthen compliance, improve transparency and reduce regulatory uncertainty.
European initiatives such as Gaia-X aim to support this objective by creating an open, secure and interoperable digital ecosystem that enables organisations to maintain greater control over their data while continuing to benefit from cloud technologies.
At the same time, decades of technological globalisation have created increasingly complex digital supply chains. When a critical provider, service or infrastructure component is disrupted, the effects can quickly cascade across entire industries. As a result, strong cybersecurity and resilient digital infrastructure have become essential foundations of digital sovereignty for businesses, governments, research institutions and critical infrastructure operators alike.
Achieving digital sovereignty requires more than a strategic vision – it demands practical action. One of the biggest challenges is designing data flows in a way that enables organisations to retain control while meeting increasingly complex regulatory requirements. Fortunately, this does not mean abandoning cloud technologies altogether.
Instead, organisations need greater visibility into how their data is managed throughout its lifecycle. Where is data stored? Who has access to it? Which legal framework applies to the data centre hosting it? As cloud environments become more distributed and interconnected, these questions are no longer easy to answer – but they are essential for maintaining compliance and reducing risk.
Today, business data often moves seamlessly between countries, cloud platforms and service providers. In many cases, multiple vendors process the same information, making it difficult to understand where data resides and who is responsible for protecting it. Creating a comprehensive data map is therefore a fundamental step towards digital sovereignty, providing the transparency needed for both effective governance and regulatory compliance.
Technology is only one part of digital sovereignty. Organisations must also navigate an increasingly complex regulatory environment that governs how data is stored, processed and protected. At the heart of Europe's legal framework is the General Data Protection Regulation (GDPR), which defines how personal data may be collected, processed and transferred. Over the past few years, the European Union has expanded this framework through additional legislation designed to strengthen data governance and cybersecurity.
One of the most widely discussed legal challenges remains the US Cloud Act. Under certain circumstances, it allows US authorities to request data from cloud providers subject to US jurisdiction – even if that data is stored in data centres located within the European Union. For organisations operating internationally, this creates a complex legal situation where different jurisdictions and regulatory requirements may overlap. Understanding these obligations is an important part of any digital sovereignty strategy.
Choosing where data is stored is only one aspect of digital sovereignty. Equally important is ensuring that only authorised users can access sensitive information, regardless of where it resides.
Encryption plays a central role by protecting data both in transit and at rest, significantly reducing the risk of unauthorised access. However, encryption alone is not enough. Effective Identity and Access Management (IAM) ensures that employees, partners and service providers receive access only to the resources they genuinely require. Together, encryption, strong authentication and granular access controls enable organisations to strengthen security while maintaining the flexibility of modern cloud environments. Rather than relying solely on physical data location, organisations gain confidence that their critical information remains protected throughout its entire lifecycle.
Bring Your Own Key (BYOK) allows organisations to retain control over the encryption keys used to protect their cloud data. Instead of relying entirely on a cloud provider's key management, organisations generate, manage and rotate their own encryption keys. This provides greater control over who can access protected data and allows access to be revoked immediately if required—provided the cloud platform supports customer-managed keys. For organisations with strict compliance or data sovereignty requirements, BYOK is an important building block for strengthening trust, transparency and control within cloud environments.
Esther Goernemann argues that no single measure is sufficient to achieve digital sovereignty. In her view, there is still no universally accepted framework for measuring digital sovereignty, and it will take time to assess the effectiveness of emerging European regulations. She emphasises that strengthening digital sovereignty requires long-term planning and the willingness to rethink established structures. For organisations, this means that digital sovereignty is not achieved through a single technology or regulatory requirement. Instead, it requires a long-term strategy that combines governance, cybersecurity and carefully selected technology partners.
Many organisations are already redesigning their cloud and security strategies to ensure that sensitive data and critical applications remain protected within trusted legal frameworks. Initiatives such as Gaia-X contribute to this objective by promoting secure and interoperable digital ecosystems, while European technology providers help organisations maintain greater transparency and control over their data.
Secure remote access also plays an important role. Modern VPN and remote access solutions developed and operated within Europe enable organisations to protect user authentication, encrypt data traffic and maintain full visibility over remote connections – all while supporting compliance with European data protection requirements.
Ultimately, digital sovereignty is not about limiting innovation. It is about enabling organisations to embrace digital transformation with greater confidence, resilience and control.
What does digital sovereignty mean for organisations?
Digital sovereignty refers to an organisation's ability to maintain control over its data, software and digital infrastructure. It also means reducing dependence on individual technology providers or foreign legal jurisdictions while ensuring transparency across increasingly complex digital supply chains. Ultimately, digital sovereignty enables organisations to make independent decisions about how their critical data is stored, processed and protected.
Which regulations shape digital sovereignty in Europe?
Europe's regulatory framework is built around the General Data Protection Regulation (GDPR), which governs the processing of personal data. Additional legislation—including the Data Act, Data Governance Act and NIS2 Directive—strengthens requirements for data governance, cybersecurity and risk management. Depending on the industry, organisations may also need to comply with sector-specific regulations, particularly in critical infrastructure and financial services.
Why is the US Cloud Act relevant for European organisations?
The US Cloud Act allows US authorities, under certain legal conditions, to request data from cloud providers operating under US jurisdiction—even when that data is stored in European data centres. This can create legal and compliance challenges for organisations that must simultaneously meet the requirements of European data protection laws such as the GDPR.
How can organisations strengthen digital sovereignty?
Building digital sovereignty requires a combination of technical, organisational and regulatory measures. Key best practices include storing sensitive data within trusted jurisdictions, implementing end-to-end encryption, maintaining control over encryption keys, applying strong identity and access management, choosing trusted cloud and remote access providers, and gaining full visibility into data flows across the organisation.
What role do VPN and secure remote access solutions play?
VPN and secure remote access technologies protect connections between users and corporate resources while ensuring that sensitive data remains encrypted during transmission. Combined with strong authentication and centralised access controls, they help organisations maintain security, support compliance and reduce dependencies on external service providers. Solutions developed and operated within Europe can further support organisations seeking greater digital sovereignty under European legal frameworks.
Cybersecurity as an Enabler for Digital Sovereignty and Innovation
Discover how a modern cybersecurity strategy helps organisations strengthen digital sovereignty, improve resilience and create the foundation for secure digital transformation.
What Is Digital Sovereignty? Benefits, Challenges and European Perspectives
You might also be interested in:
Always-On VPN vs. On-Demand VPN: What Matters for Your Network Security
Compare Always-On VPN and On-Demand VPN for secure remote access. Learn which VPN strategy supports Zero Trust security, compliance requirements, and optimal network performance.
ESG Governance: Trust as the key to sustainable IT, compliance and information security
Today’s episode of Tobi’s Take is a special one for two reasons. First, we’re taking a short break from our series after covering the core areas of our ESG sustainability strategy. Second, I’m joined by a guest to explore the “G” in ESG — Governance
Secure by Default: Why Cybersecurity Must Start with Default Settings
Secure by Default is becoming the new cybersecurity standard. Learn how NIS-2, GDPR, and the Cyber Resilience Act are transforming IT architecture, remote access, and compliance requirements.
![[Translate to Englisch:]](/fileadmin/user_upload/NCP_Blog/2026/Security_by_default.jpg "[Translate to Englisch:]")