For years, the promise of cloud computing has been that location shouldn’t matter. Applications can run anywhere, data can move between regions, and organisations can access technology on a scale that would once have required enormous investment in their own infrastructure.
But there’s a growing complication. The cloud might be borderless by design, yet the laws governing data, the organisations controlling infrastructure and the geopolitical risks surrounding technology most certainly are not.
Data sovereignty is moving up the agenda. The question is no longer simply where your data lives, but who controls it, which laws apply and how much independence you retain if circumstances change.
Beyond the data centre
Microsoft’s latest announcement, Advancing digital sovereignty with greater control and choice, published on 20 October, illustrates how seriously the market is taking this challenge.
Building on its sovereign cloud initiative launched in 2025, Microsoft is expanding capabilities across public cloud, private cloud and partner-operated environments. New and evolving features include greater visibility of sovereignty controls, additional oversight of certain administrator access, external management of encryption keys and options for operating workloads in disconnected environments.
The underlying idea is that organisations should be able to choose the level of control appropriate to each workload without necessarily abandoning the benefits of hyperscale cloud.
That is a sensible direction. But it also raises an important question: what do we actually mean by sovereignty?
Keeping data within UK borders can be an important requirement. It does not, by itself, establish who can access that data, which legal obligations apply to the provider, who operates the infrastructure or whether critical services can continue if external support becomes unavailable.
The UK’s own government guidance on cloud hosting recognises that data stored in the UK may still be accessed by personnel overseas. Location is one consideration; access, jurisdiction and operational control are others.
In other words, drawing a border around your data does not necessarily draw a border around the risks.
Data Sovereignty is becoming a procurement decision
This isn’t just a debate among cloud providers. Governments are translating the principle into purchasing decisions.
On 20 October, Switzerland launched its Swiss Government Cloud procurement, setting out three coordinated cloud levels: global public cloud, public cloud with enhanced data governance, and on-premises private cloud for particularly sensitive applications. The stated objectives include greater flexibility, open standards, security and operational autonomy.
The approach is significant because it doesn’t treat sovereignty as an all-or-nothing choice. Different workloads have different requirements, and the infrastructure should reflect those requirements. The procurement also seeks to reduce dependence on individual providers and jurisdictions.
The European Commission is taking a similarly structured approach. Its Cloud Sovereignty Framework assesses providers against 48 criteria across eight areas, including legal and jurisdictional control, technology, operations, supply chains, security and compliance. Data residency matters, but it is only one part of the assessment.
Sovereignty is becoming something organisations need to evaluate and demonstrate, rather than simply accept as a provider’s marketing claim.
Drawing the right boundaries
None of this means that public cloud is inherently unsuitable, or that every organisation should bring its workloads back in-house. Hyperscale platforms offer capabilities, resilience and innovation that would be difficult and expensive for many businesses to replicate.
Equally, keeping everything with one provider can create dependencies that are difficult to unwind. The ability to move a workload is of limited value if the necessary data, skills, connectivity, software licences or operational expertise cannot move with it.
The sensible response is to understand which workloads genuinely require additional sovereignty controls, where those controls need to sit and what happens if a provider, connection or jurisdiction becomes unavailable.
For some organisations, that may mean hyperscale public cloud with additional safeguards. For others, it may mean private cloud, locally operated infrastructure or a combination of services across more than one provider and jurisdiction.
For organisations that need greater control over where their data resides and how their infrastructure is operated, independent providers also have an important role to play.
vXtream offers facilities in both the UK and Switzerland, providing an alternative to relying entirely on a hyperscale provider. Its combination of UK and Swiss infrastructure, private cloud and managed services gives organisations more choice over where workloads run and how they are supported.
The important point is not that one model fits every requirement, but that organisations should have meaningful options when deciding where control needs to sit.
The cloud needs borders. But who draws them?
Data sovereignty is not about building walls around every workload. It is about knowing where the boundaries should be, understanding what those boundaries protect and retaining meaningful choices when circumstances change.
For CIOs, CTOs and CISOs, the practical questions are straightforward. Where is our data stored, processed and backed up? Who can access and administer the systems? Which jurisdictions can affect the service? What dependencies could prevent us from operating independently? And could we move if we needed to?
The answers will differ between organisations and workloads. What matters is that they are understood before a decision is made, not discovered during a crisis.
The cloud has made infrastructure more flexible than ever. The next challenge is ensuring that flexibility does not come at the expense of control.
Because true data sovereignty isn’t just about knowing where your data lives. It’s about knowing who holds the keys, who sets the rules and whether you retain a meaningful choice.
Please reach out if you’d like to discuss data sovereignty in detail.
If you found this article of interest, please don’t forget to sign up for our NEWSLETTER for the latest industry news and insights delivered direct to your mailbox.
Image by Tumisu from Pixabay
Comments are closed.