Digital governance in your own hands: this is what you need to know about the sovereign cloud

We are in quite dependent on the software, applications and platforms of large tech companies. With geopolitical developments, there are increasing risks of foreign parties gaining unauthorized access to your organization's data. It is even conceivable that access to your systems and applications could be blocked. For example, the chief prosecutor of the International Criminal Court in The Hague was suddenly denied access to Microsoft applications.

Digital sovereignty in the cloud

Digital sovereignty is therefore now a key word. Many Dutch organizations are looking for new ways to store data securely with an external provider, such as a European cloud provider. A European-made cloud gives you more control over data management and more visibility into compliance with laws and regulations, such as the General Data Protection Regulation (AVG) and the future Cybersecurity Act.

Digital sovereignty in the cloud means that, as an organization, you have complete control over your data and IT environment. So that foreign governments cannot access your data, or restrict or stop services. This goes beyond storing data in European data centers. The management, support and organization of the cloud provider must also fall under European jurisdiction. This is necessary to prevent, for example, American or Chinese companies (and the laws and regulations there) from impacting the protection of your data and/or the availability of your services, even if the data centers are located in Europe.

Moving to a sovereign cloud

A complete transition to a European cloud solution is no easy task. The migration involves complex technical issues, such as the formats in which data are transferred to the new environment. Practical issues also require attention. Consider the careful phasing of the transition, so that essential data is always sufficiently accessible and users are well informed about the new way of working.

American cloud providers, including Microsoft and Google, now offer options to transfer data to an online environment you choose, such as from a European partner. You then retain the applications and functionalities you are used to, for example, from a word processing program and/or an AI chatbot. Furthermore, you decide whether to process data via a public or a private cloud. You can then choose to have all data processing take place in the EU, with European employees at the helm. Or you use a local provider's data center, or even your own data center, for critical workloads.

Considerations for a sovereign cloud solution

With a thoughtful choice of cloud service, you take an important step toward digital independence. A sovereign cloud contributes to risk management around information security, compliance with laws and regulations and responsible supplier management.

With all the focus on the EU's digital independence and cyber resilience, more and more providers are claiming a sovereign cloud. It is important to look critically at products and services. Where is data stored, managed and backed up? Which vendor employees have access to the data - and which partners does the vendor use? What legal regimes apply to the data your organization houses in a cloud environment?

Another concern is the responsible and secure use of cloud services. You want data to be continuously available to those authorized to do so, and not fall into the wrong hands. What information security measures does a cloud provider take? How is continuity of service guaranteed? What exit strategies are in place? As an organization, you are responsible for adequately addressing the risks, including monitoring supplier practices and compliance. Whether the cloud solution is sovereign, or not.