What is digital sovereignty?
Digital sovereignty is the ability of a state, organisation, or individual to autonomously decide over digital infrastructure, data, and applications. In Germany, the term is shaped especially by GDPR, the NIS2 directive, and the Schrems II ruling — with the US CLOUD Act as the extraterritorial counter-pole.
Important: sovereignty is not equivalent to national isolation or hyperscaler abstinence. It is a question of control, traceability, and freedom of choice — and that is precisely the difference between a marketing slogan and an operational reality.
Three dimensions of cloud sovereignty
A workable model splits sovereignty into three dimensions:
- Data sovereignty — where do the data live? Who has legal access? Data residency alone isn’t enough: a US provider with an EU data centre remains subject to the CLOUD Act regardless of storage location.
- Operations sovereignty — who operates the infrastructure, who has personnel access (logical and physical)? Operating personnel located inside the EU shifts the risk profile considerably.
- Software sovereignty — which software stack? Open standards, IaC reproducibility, hexagonal architectures, and exit capability keep the door open for provider switches.
Sovereignty starts in management, not the data centre
The most important insight from the field: real sovereignty doesn’t emerge from a single technical decision, but from a coordinated governance model. Where business and IT develop a cloud strategy together, risk drops, decisions speed up, silos are avoided. Where that is missing, shadow IT and non-auditable data flows grow.
Frameworks help: BSI C5, ISO/IEC 27001, SOC 1–3 structure compliance. But frameworks don’t replace a decision hierarchy: who makes cloud architecture decisions? Who reviews? Who escalates?
AWS European Sovereign Cloud (ESC)
The AWS European Sovereign Cloud is the most prominent hyperscaler answer to European sovereignty requirements: a cloud region operated entirely within the EU and legally separate. Core characteristics:
- EU-operated partition: operations exclusively by EU personnel, with its own certificates and root authorities.
- EU-based metadata storage: no metadata leaves the EU.
- Independent identity and billing system: separate from the global AWS platform.
- Service portfolio of the global AWS platform with European control and governance mechanisms.
For IT decision-makers this means: sovereignty is also achievable with global cloud providers, provided technical, legal, and organisational controls interlock. The ESC closes the gap for KRITIS operators, financial services, and public institutions without forcing them to give up public-cloud service breadth.
Provider landscape in comparison
Germany’s cloud landscape is becoming more differentiated:
- National providers: IONOS, STACKIT (Schwarz Digits), Open Telekom Cloud — fully German operations, narrower service depth.
- EU-sovereign hyperscaler models: AWS European Sovereign Cloud, Microsoft EU Data Boundary, Google Sovereign Controls — full service breadth with European controls.
- Classic public-cloud regions in the EU: Frankfurt, Dublin, Milan — full breadth, but subject to the CLOUD Act.
The right choice depends on the workload. A 23-category decision compass structures the evaluation — see the deeper dives below.
Sovereignty as a strategic process
The path to a sovereign cloud organisation follows a clear sequence:
- Sovereignty assessment — readiness check, regulatory mapping (GDPR, NIS2, KRITIS, BaFin), workload classification.
- Target architecture — landing zone, policy set, role model, KRITIS/BaFin blueprints.
- Pilot workloads — Infrastructure-as-Code, guardrails, gate decisions.
- Continuous compliance — policy-as-code, audit trails, regular reviews, evidence management.
Sovereignty is not a vendor label — it’s a property of your own operating model.
Deeper dives
Frequently asked questions about digital sovereignty
What is the difference between data location and data sovereignty?
Data location only describes where data physically reside. Data sovereignty answers the more important question: who has legal access to the data? A US hyperscaler with an EU data centre is subject to the US CLOUD Act regardless of storage location. Sovereignty therefore requires both data location and operational/legal separation.
Is the AWS European Sovereign Cloud GDPR-compliant?
Yes, the AWS European Sovereign Cloud is explicitly designed for GDPR and EU data-protection law. EU-only operations, EU-based metadata storage, and a separate identity and billing system create the structural prerequisites. As with any cloud service, GDPR compliance at workload level must be established by the using organisation (controller obligations, records of processing, technical and organisational measures).
How does the US CLOUD Act apply to European cloud services?
The US CLOUD Act empowers US authorities to request data from US companies — regardless of physical storage location. Consequence: a US provider with an EU data centre remains in principle CLOUD-Act-subject. Sovereignty models like the AWS European Sovereign Cloud address this through legally separated EU entities and EU-operated operations.
Which frameworks help with cloud-sovereignty assessment?
BSI C5 (Cloud Computing Compliance Criteria Catalog), ISO/IEC 27001 (ISMS), SOC 1–3 (Service Organization Controls). For specific industries: BaFin requirements (financial services), KRITIS requirements (critical infrastructure), GxP/MDR (healthcare). At strategic level, the 23-category decision compass structures provider evaluation.
Does digital sovereignty make hyperscaler use impossible?
No — on the contrary. Digital sovereignty means informed freedom of choice, not isolation. Global cloud providers are usable when the required technical, legal, and organisational controls interlock. EU-sovereign hyperscaler models (AWS ESC, Microsoft EU Data Boundary) exist explicitly for that purpose.
What is NIS2 and how does it relate to sovereignty?
The NIS2 directive is the EU’s second cybersecurity directive that has, since 2024, expanded security and reporting obligations for critical and important sectors. It is not a direct sovereignty law, but it enforces resilience requirements that directly affect cloud architecture: supply-chain security, incident reporting, multi-factor authentication, recovery capability. For KRITIS operators, NIS2 fuses with sovereignty requirements.
