When public cloud took the infrastructure market by storm nearly twenty years ago, many organisations accepted a degree of uncertainty about exactly where workloads and data were hosted in return for lower costs and on-demand capacity. After all, these were two of the major selling points that helped propel the cloud revolution and create an industry now worth over a trillion dollars worldwide.
Yes, data location mattered in specific, regulated contexts, but it had yet to become the strategic and regulatory priority it is today. Fast forward to 2026 and geopolitical tensions have added significant urgency to the data sovereignty movement, while lawmakers have taken a more active interest in how cloud services are governed in general.
The international market dominance of US-based hyperscalers has also raised concerns about jurisdiction, particularly since the US Cloud Act came into force. Notably, this allows US authorities to seek certain data from US service providers, even when that data is stored overseas. As a recent report from Capgemini points out, “Reliance on global suppliers across cloud, software, hardware, and connectivity continues to expose organisations to concentration risk, limited visibility, and lengthy switching timelines.”
As a result, the typical domestic or European enterprise must now carefully consider where its data is stored and the laws that apply to the providers that hold it. Physical location alone does not necessarily settle the question of jurisdiction.
The practical case for digital independence
For IT leaders, relationships with cloud providers can directly (and legally) affect their organisation’s ability to retain control when political conditions or commercial terms change, and ideally, they should limit their exposure. Capgemini found that “nearly two-thirds (65%) of organisations concur that excessive reliance on foreign providers poses a significant risk to digital resilience.”
But let’s also be clear, the aim is rarely complete separation from international technology providers; few organisations could achieve that in practice.
Indeed, according to Capgemini, 59% of organisations regard full digital sovereignty as unrealistic. A more achievable objective is to understand where dependence exists and ensure there are credible alternatives for those workloads that require greater control. More specifically, sovereignty requirements will almost certainly vary from one workload to another. Top of the priority list, therefore, should be sensitive customer data and business-critical systems which may require a higher level of control.
But other workloads can remain with established international providers where they meet the organisation’s operational needs and risk tolerance. It all depends on the existing set of dependencies and where they might be incompatible with organisational governance or the relevant regulatory frameworks.
For UK and European businesses, local cloud providers can give organisations a credible option for workloads that can’t remain with foreign-owned providers, US hyperscalers included. It almost goes without saying that the ability to move a workload to a local provider that operates under local rules is a huge advantage should circumstances change with little or no warning.
For example, a UK insurer may potentially host its core policyholder database with a US hyperscaler. If a change in regulation or legal interpretation made that arrangement unacceptable, it would need a route to move that workload to a UK-operated cloud provider without – and this is crucial – disrupting the systems used to process claims.
Organisations also need clear answers about the contractual terms that would apply if they chose to leave an existing provider. These issues may include exit clauses that determine how much notice an organisation must give before it can move on, as well as the familiar issue of egress charges. In the EU, the Data Act will ban switching charges, including egress fees linked to changing provider, from 12 January 2027.
The ban does not cover routine data transfer charges, or egress from multi-cloud environments, which can still be charged at cost. The UK currently has no equivalent law, although AWS and Microsoft made voluntary commitments to the UK’s Competition and Markets Authority (CMA) in March 2026 to reduce egress fees for UK customers.
Local cloud opportunities
Opting for local cloud partnerships is one thing, but maintaining the performance and support levels required to meet operational standards is another. A local cloud provider is only useful when it ticks all the boxes.
For example, the ability to move data is important, although moving an application can be much more complex where it depends on provider-specific services. A sovereignty strategy should therefore consider how readily workloads could be moved before circumstances make a change necessary.
A local cloud provider should be in a position to support migration strategies and offer the flexibility and scalability that made public cloud attractive in the first place. Customers also need access to practical infrastructure expertise during the move and once the workload is live.
But increasingly, change is required, and a local partnership can significantly strengthen digital independence by giving organisations a viable route to deploy sensitive workloads under local governance. Going forward, the objective for IT leaders should be to take advantage of the meaningful choices that now exist between sovereign and foreign cloud providers, rather than sticking with any single platform that might prove difficult to unwind.