In the event that hyperscaler entities fail to secure one country's data from encroachment by another, ominous consequences are imminent.
In the rapidly evolving landscape of cloud computing, US-based providers are grappling with a complex regulatory environment in the European Union (EU) that emphasises data sovereignty. This focus on data sovereignty mandates strict control, transparency, and legal protections over EU personal and industrial data, significantly affecting US-based cloud providers operating in or serving the EU market.
The EU's Data Sovereignty Regulations
The Data Governance Act, effective since 2023, and the Data Act, effective September 2025, promote EU "data spaces" mandating data sharing under EU oversight. This requirement potentially forces providers, including US-based ones, to allow data access to EU users and third parties within EU jurisdiction, often free of charge.
The General Data Protection Regulation (GDPR), which remains foundational, strictly regulates international transfers of personal data and requires case-by-case assessments of foreign government requests to access EU data. The GDPR also prohibits the automatic recognition or enforcement in the EU of foreign legal demands, such as US government requests, to disclose personal data unless under an existing international agreement or treaty.
Additional laws such as the Digital Operational Resilience Act (DORA) and the NIS2 Directive also require increased data access controls, operational transparency, and resilience measures reflecting increased sovereignty concerns.
Implications for US-Based Cloud Providers
The stringent data sovereignty rules in the EU present several challenges for US-based cloud providers. These include:
- Increased Compliance Complexity: Providers must implement rigorous processes to verify the legality of foreign data access requests, potentially facing refusals and operational friction when EU demands conflict with US government subpoenas.
- Greater Data Localization and Sovereignty Measures: EU clients and governments are demanding guarantees about who controls data and legal jurisdiction, not just physical storage location. This challenges US cloud firms whose infrastructure or parent companies are subject to US extraterritorial laws like the CLOUD Act.
- Risk of Limited Market Access or Customer Loss: Without sufficiently transparent and sovereign-aligned solutions, European organizations may avoid or restrict US cloud providers.
- Strategic Autonomy Tensions: The EU’s ambition for digital and technological independence under the umbrella of sovereignty conflicts with the realities of global data interdependence and US cloud dominance.
Potential Solutions and Uncertainties
The article also implies the need for a strong international framework to address data sovereignty concerns. On-prem services offer the ultimate safeguard against legal, invisible, state-sponsored snooping. However, the question of whether on-prem data security will be as good as that of the hyperscalers arises.
There is uncertainty about what will happen if you want to operate in markets with data sovereignty restrictions not to your advantage. Last year, the UK government used its sovereignty to demand a backdoor into Apple's encryption services. Apple did not comply, leading to potential consequences.
The EU might mandate that sensitive data cannot be stored or processed where non-EU entities can demand access. This potential mandate could also benefit EU-homed cloud providers. Skepticism is warranted regarding Microsoft's data safety pledge, and the credibility of claims to defend EU data must be judged by the reader.
In summary, the EU's data sovereignty rules demand strong data protection, legal jurisdiction control, and transparency. This environment, reinforced by new data governance laws effective from 2023 to 2025, will require significant technical and legal adaptations by US firms to maintain their EU presence and competitiveness.
[1] European Commission. (2023). Data Governance Act. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12523-Data-Governance-Act
[2] European Commission. (2018). General Data Protection Regulation (GDPR). https://ec.europa.eu/info/law/law-topic/data-protection/reform/general-data-protection-regulation_en
[3] European Commission. (2021). Digital Operational Resilience Act (DORA). https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12519-Digital-Operational-Resilience-Act_en
[4] European Commission. (2021). NIS2 Directive. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12518-NIS2-Directive_en
[5] European Commission. (2020). A European approach to artificial intelligence. https://ec.europa.eu/info/publications/european-approach-artificial-intelligence_en
[6] European Commission. (2022). Data Act. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12655-Data-Act_en
- The Data Governance Act, effective from 2023, and the Data Act, effective September 2025, are EU regulations promoting "data spaces" under EU oversight, potentially forcing data access by the EU and third parties under its jurisdiction, affecting US-based cloud providers.
- The GDPR, which remains foundational, strictly regulates international transfers of personal data and requires assessments of foreign government requests to access EU data, prohibiting the automatic recognition of foreign legal demands under EU jurisdiction without an existing international agreement.
- Additional laws such as the Digital Operational Resilience Act (DORA) and the NIS2 Directive also require increased data access controls, operational transparency, and resilience measures, reflecting increased concerns over data sovereignty.
- US-based cloud providers face challenges in the EU due to stringent data sovereignty rules, including increased compliance complexity, greater demands for data localization and sovereignty measures, risk of limited market access, and strategic autonomy tensions.
- The EU might require that sensitive data cannot be stored or processed where non-EU entities can demand access, potentially benefiting EU-homed cloud providers, and skepticism is warranted regarding the credibility of claims to defend EU data.
- The EU's data sovereignty rules demand strong data protection, legal jurisdiction control, and transparency, requiring significant technical and legal adaptations by US firms to maintain their EU presence and competitiveness.
