Cloud Sovereignty Data Sovereignty and Cloud Services – A Contradiction?

Related Vendors

gridscale GmbH

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

The EU is setting the course with new regulations for a digital future where economic success and data protection are not contradictory. The goal is to create a reliable legal framework for a European data single market and to sustainably secure control over data.

The Federal Office for Information Security (BSI) defines digital sovereignty as "the abilities and capabilities of individuals and institutions to independently, autonomously, and securely exercise their roles in the digital world." For companies, this means, for example, that they can freely choose their provider and technologies and switch if needed. An important aspect of this is also data sovereignty, which refers to having full control over one’s own data at every stage—from collection and storage to processing and usage.

Precisely because of these considerations, companies in highly regulated industries have hesitated and continue to hesitate to use cloud services. Their concerns are justified, as the ongoing discussion over the years has shown: American hyperscalers are subject to U.S. law. It essentially does not matter where their data center is located or in which country companies book services. Under certain conditions, the U.S. Cloud Act obliges American IT service providers to disclose their customers’ data, even if that data is not stored in the U.S. Geopolitical tensions and global economic uncertainties only add to the complexity of the situation.

EU Regulations Create Opportunities And Obligations

Thus, regulatory requirements ranging from the GDPR to the Data Act and AI Act to the NIS-2 Directive may sometimes be perceived as obstacles and challenges. At the same time, they are an important part of European industrial policy, which takes digital sovereignty and data protection seriously. Moreover, the Data Act, the AI Act, and other regulations such as the Data Governance Act or the Digital Markets Act specifically aim to provide legal certainty for the commercial use of data.

With the Data Act, the EU aims to ensure that the vast amounts of non-personal data, such as those generated in smart industrial sectors, can be better utilized by various stakeholders. Until now, the data often remains with manufacturers and service providers—frequently, even their customers, who are actually the originators of the data, do not have access to it. In the future, only the user—that is, the one who generates the data—will decide what can happen to it. They will also determine whether to share it with third parties and how to avoid vendor lock-ins. Small businesses and start-ups will also benefit from the data. They can use it to develop new products and services or optimize processes.

Technological Answers: Europe's Clouds in Competition

Of course, a regulatory response alone is not enough to counter the market dominance of the American hyperscalers. A technological response is also needed, and it already exists: The offerings of European and German cloud providers are internationally competitive. This is evident in the technical capabilities, scalability, and variety of services ranging from SaaS to IaaS to PaaS. Last but not least, they are also competitive in terms of price.

In addition, there are some decisive advantages: The most important is the location advantage. Cloud providers based in the EU, like all other companies, must comply with stringent European regulations. If they want to use this compliance as a selling point, they must provide their customers with corresponding assurances. And that is exactly what cloud service providers are doing: With data centers that are geo-redundantly set up in EU countries, data storage and processing that always complies with European law can be ensured. Furthermore, more tailored concepts can be implemented with medium-sized providers. Additionally, consultancy and service are more personalized.

For companies seeking a cloud infrastructure, it is important to compare various providers. They should also consider multiple scenarios with a long-term perspective. Can global legal uncertainties be reconciled with their own requirements for compliance, governance, and sovereignty? The sense of being in good hands with a global player simply because they are a global player is deceptive. Long-term cloud strategies are equally possible with less dominant, local cloud providers. The European market is well-connected and actively contributes to legislation through industry associations and collaborations between business and politics. For example, the industry association Euro Cloud, affiliated with the Internet Industry Association Eco, aims to promote the European cloud market and create more transparency and guidance for users.

AI And IoT: Why Decentralized Clouds Are in Demand Now

The growing data volumes in the IoT sector are driving further development, where local providers take the lead. The centralized cloud approach reaches its limits or becomes expensive when massive amounts of data are generated in real-time and need to be transmitted and analyzed.

Decentralized edge resources can mitigate this: Data is pre-processed, filtered, or aggregated directly at its point of origin. Sometimes, a small chip built directly into the device, as is typical with IoT devices, is sufficient. However, it can also be beneficial to establish so-called edge-cloud infrastructures, which function as decentralized cloud data centers built geographically close to the customer, minimizing latency and thus enabling IoT and AI.

An interesting collaboration is currently implementing such edge clouds in the Paderborn region: The wind turbine operator Westfalen Wind and the Cologne-based cloud specialist Gridscale, which is part of the European market leader OVH Cloud, are installing data centers in wind turbine towers. This makes Westfalen Wind a local, sovereign cloud provider. With Gridscale's platform, all infrastructure components can be managed, while customers are offered a self-service portal and extensive services.

Cloud Usage And Data Sovereignty: A Gain in Flexibility

Using cloud services while retaining full control over your data is not mutually exclusive. The key is that the chosen services meet the requirements for digital sovereignty. The focus here is not on political principles but on practical advantages: Those who have sovereign control over their data can use it purposefully, share it securely, and thereby increase efficiency, innovation, and competitiveness.

Henrik Hasenkamp is the CEO of Gridscale.

Secure and Compliant Authentication in Laboratories

Secure & Contactless User Authentication at GMP/GLP