Data sovereignty is becoming an important consideration in the regulation of digital services, and extends beyond where personal data is stored or processed to encompass cloud infrastructure, access to critical technologies, foreign governmental access, supply chain dependencies and the extent to which organisations retain effective control over their data and the services on which they rely.
Photo credit: Planet Volumes / Unsplash+
Key Takeaways
- The European Commission is developing a more structured approach to cloud sovereignty. Its Cloud Sovereignty Framework has been applied in a major EU institutional procurement exercise, with four providers awarded contracts worth up to EUR 180 million over six years. Separately, the proposed Cloud and AI Development Act would establish four EU-wide Union Assurance Levels for cloud services supplied to public sector bodies.
- Member States continue to pursue their own paths. France has placed trusted-cloud requirements on a statutory footing for specified sensitive state data, with SecNumCloud 3.2 approved as the applicable requirements framework in August 2026. Germany has developed complementary approaches through the BSI's C5 security assurance framework and its newer C3A criteria for cloud autonomy.
- The UK is taking a different approach. Its emphasis is on resilience, risk management, supplier diversity and domestic technological capability, including through the National Cloud Infrastructure Programme, rather than any general requirement to store or process data in the UK.
- Sovereignty is assessed by reference to control, rather than location alone. A provider’s governing jurisdiction, ownership and control arrangements, access to encryption keys, operational dependencies and exposure to third-country laws are becoming as relevant as the location of its data centres.
For multinational businesses, the challenge is not simply to identify where data is held, but to understand who controls the infrastructure and services through which it is processed, which laws may affect access to it and what contractual and technical assurances are available.
The Legacy EU Framework
Member States may not restrict the free movement of personal data within the Union on data protection grounds, and Regulation (EU) 2018/1807 extends the same principle to non-personal data. But data sovereignty raises a different question: not whether data can move, but who controls it wherever it is held.
For personal data, Chapter V of the GDPR regulates transfers to third countries, Article 48 provides that a third-country judgment or administrative decision requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable where based on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer under Chapter V GDPR. However, these rules do not address the broader questions of infrastructure ownership, operational control and technological dependency that are central to digital sovereignty.
For non-personal data, the starting point is Article 4 of Regulation (EU) 2018/1807, which prohibits Member State data localisation requirements unless justified on grounds of public security, and without prejudice to localisation requirements under existing EU law. Member States therefore cannot generally pursue sovereignty by requiring non-personal data to remain within their territory. (The Commission's Digital Omnibus proposal would repeal Regulation (EU) 2018/1807 and incorporate its provisions on free flow of data into the Data Act. The proposal remains subject to the EU legislative process, so the existing Regulation continues to apply).
More recently, Article 32 of the Data Act now requires providers of data processing services to take all adequate technical, organisational and legal measures, including contractual measures, to prevent international and third-country governmental access to, and transfers of, non-personal data held in the Union where these would conflict with EU or Member State law. Additionally, Article 31 of the Data Governance Act imposes an equivalent obligation to take all reasonable measures on a narrower group — namely, public sector bodies, re-users of protected public sector data, data intermediation services providers and recognised data altruism organisations.
The Evolving EU Framework
Recent initiatives have been driven in part by concerns about Europe’s reliance on a relatively small number of non-European providers for critical digital services. Those concerns extend beyond exposure to third-country laws — including the U.S. CLOUD Act — to the risk of operational disruption and the limited availability of alternative technologies and suppliers. Against that backdrop, the European Commission is not proposing a general requirement to use European-owned providers or host all data within the EU, but rather is developing a tiered approach under which the level of sovereignty required can be assessed by reference to the service, sector and intended use.
The Cloud Sovereignty Framework
In October 2025, the Commission launched a procurement exercise under its Cloud III Dynamic Purchasing System, using its newly developed Cloud Sovereignty Framework to assess providers of sovereign cloud services for EU institutions, bodies, offices and agencies. The procurement was worth up to EUR 180 million over six years.
The framework assesses services against eight sovereignty objectives, covering strategic, legal and jurisdictional, data and AI, operational, supply chain, technological, security and compliance, and environmental considerations. These objectives are assessed through a combination of a Global Sovereignty Score, based on 48 criteria, and Sovereignty Effectiveness Assurance Levels (SEALs), ranging from SEAL-0 to SEAL-4. The higher levels indicate progressively greater sovereignty and resilience, with SEAL-2 representing data sovereignty, SEAL-3 technological autonomy and SEAL-4 full sovereignty.
In April 2026, the Commission awarded contracts under the procurement to four providers. The tender required providers to achieve at least SEAL-2, while three of the successful providers achieved SEAL-3. The successful procurement was intended not only to provide cloud services to EU institutions but also to promote supplier diversification and reduce dependence on individual providers.
The framework is instructive because it does not necessarily exclude non-European technology. For example, the successful partnership led by Proximus, involving services from S3NS (a joint venture between Thales and Google Cloud), Clarence and Mistral, achieved SEAL-2. This illustrates that the relevant question is not necessarily whether every component of a cloud service is European-owned, but whether the service is operated within arrangements that provide the required level of control and resilience. e operated within arrangements that provide the required level of control and resilience.
The Cloud and AI Development Act
The Commission’s proposed Cloud and AI Development Act (CADA), adopted in June 2026 as part of its Tech Sovereignty Package, would take the Commission’s approach a stage further. Its objectives include supporting cloud and AI innovation, accelerating the deployment of data centres across the EU and promoting technological autonomy through a common sovereignty assessment framework.
The proposal would establish four EU assurance levels, intended to provide progressively greater assurance concerning infrastructure location, operational independence, ownership and control, supply chain dependencies and protection against third-country interference. The highest levels would be reserved for services where the consequences of losing control or access justify more demanding safeguards. Providers would apply to national competent authorities for recognition of a service at a particular level, while Member States would undertake sovereignty risk assessments to determine which public sector activities and use cases require different levels of assurance.
CADA remains subject to the EU’s ordinary legislative procedure and is not yet binding, so its final requirements may change. Nevertheless, it signals the Commission’s intention to move towards a common EU-wide framework, rather than leaving public authorities to develop their own sovereignty criteria.
Implications For Businesses
For multinational organisations, particularly those operating in financial services, life sciences, healthcare and critical infrastructure, four issues merit particular attention.
- Identify where sovereignty requirements apply. Organisations should distinguish binding legal obligations from policy objectives and commercial expectations. For example, a specific procurement requirement, such as the French statutory requirements for sensitive state data, may be decisive for a government supplier without applying to its commercial customers.
- Review cloud and technology dependencies. Organisations should understand not only where their data is stored, but also which entities can access or control the relevant systems. This includes dependencies arising through subcontracting, remote administration, technical support and third-country infrastructure. The assessment should extend beyond the immediate cloud provider to the wider supply chain.
- Assess contractual protections. Cloud and outsourcing contracts should address data location, notification of changes to service arrangements, subcontracting, access controls, encryption keys and the handling of governmental access requests. For EU customers, the obligations imposed on providers under Article 32 of the Data Act are particularly relevant. Contractual assurances should, however, be assessed alongside the provider’s technical and operational arrangements.
- Monitor the development of EU-wide requirements. Although neither the Cloud Sovereignty Framework nor CADA imposes general requirements on private sector organisations, both are likely to influence the criteria applied by public authorities and customers when selecting cloud providers. Providers that can demonstrate recognised levels of sovereignty assurance may therefore gain a commercial advantage, particularly when competing for public sector contracts or supplying customers with demanding security and resilience requirements.
Looking Ahead
There is no single model of data sovereignty emerging across Europe and the UK. The EU is moving towards a more structured approach, emphasising technological autonomy, control over critical infrastructure and reduced strategic dependencies, while Member States retain distinct approaches. For its part, the UK favours a more flexible model centred on control and assurance, resilience, supplier diversity and domestic technological capability, without imposing any general data localisation requirement.
For businesses operating across the EU and UK, these differences make it important to understand who controls their data, which laws may affect access to it and how their dependencies on third-party technology providers are managed. Identifying where data is stored remains important, but it is no longer sufficient on its own. As a result, data sovereignty is becoming a question of whether the arrangements surrounding the storage and processing of data provide sufficient legal, operational and technological control.
Subscribe to Ropes & Gray Viewpoints by topic here.
Published by
Ropes & Gray LLP
Ropes & Gray LLP
