Imagine a customer asks a simple question: where is my data? For years, the honest answer at many companies was “in the cloud,” followed by a slightly awkward pause. The cloud felt like weather, something that just exists. Today a regulator, a bank client or a board member may ask the same question and expect an exact answer, plus a second one: who else can reach it?
The cloud is somebody’s building
Cloud storage is physical. Your files sit on servers in a data centre in a particular country, run by a company headquartered in a particular country, and both facts can matter. For a long time that was a technical detail. It has become a business issue because governments now treat data as a strategic asset, and the rules about who can demand it differ from place to place.
Residency is not sovereignty
This is the idea most people mix up. Data residency means your data is stored in a certain location, such as a data centre in the EU or the UAE. Data sovereignty is about whose laws can reach it, and the two aren’t the same thing.
The classic example is the US CLOUD Act of 2018. It obliges US providers to hand over stored data on order, regardless of where in the world that data physically resides. Law firm Clifford Chance has noted that even local European companies may receive an order under the CLOUD Act, depending on their ties to US entities. So a European data centre run by a US-parented provider can still sit inside a legal tension: obey one government’s request and risk breaching another’s data protection rules.
There’s real debate about how much this matters in practice, and about whether technical measures like local encryption keys close the gap. Some commentators say no architecture can change a provider’s home jurisdiction. Others argue that strong controls reduce the risk to something manageable. Both views deserve a hearing, and your lawyer should weigh in, not a vendor’s brochure.
The rules are catching up
Europe is the clearest case of regulation catching up. The EU Data Act has applied since 12 September 2025, covering cloud switching rights, limits on vendor lock-in and protections against data access by non-EU governments. In June 2026, the European Commission proposed the Cloud and AI Development Act, aimed at the shortage of EU data centre capacity and reliance on a handful of non-EU cloud providers. Notably, it does not impose outright localisation or exclusion requirements, relying instead on graduated safeguards. If it passes, “sovereign cloud” would shift from a sales pitch to a graded, regulated standard, though the details may change before then.
The same logic is spreading elsewhere. In the UAE, the Personal Data Protection Law applies to any organisation that processes personal data of people in the UAE, wherever the organisation is based, and the DIFC and ADGM keep their own regimes. A Red Hat survey found that data protection and sovereignty goals remain priorities on UAE IT agendas, with AI adding complexity to cloud strategies. A company serving customers across borders can’t assume one set of rules.
The market is responding
Cloud providers have noticed. AWS announced a €7.8 billion investment in its European Sovereign Cloud, and other big providers have launched partner-operated models and “data boundary” offerings. One forecast, quoted by a cloud vendor, projects European sovereign cloud spending to grow 83% in 2026. Treat that figure cautiously, since the source sells sovereign cloud services, but the direction is hard to miss.
It’s not only about law
Even if no regulation applied to you, location and control would still matter for plain operational reasons.
- Lock-in. If leaving a provider is expensive and slow, you’ve lost negotiating power. The EU’s switching rules exist because this became a real problem.
- Concentration. When many firms depend on a few providers, one outage or dispute spreads far and wide.
- AI workloads. Training and running AI means feeding large amounts of data to cloud systems. Knowing what goes where, and under whose rules, gets harder fast.
- Customer trust. Banks, hospitals and government clients increasingly ask where data lives before they sign a contract.
Questions worth asking your provider
You don’t need to be a lawyer to start. Ask these:
- In which countries is our data stored, backed up and processed?
- Which company, and which country’s laws, ultimately control the provider?
- Who holds the encryption keys, and can the provider access our data without us?
- How would you respond to a foreign government’s order to hand over our data? Would you tell us?
- Which subcontractors touch our data?
- How quickly and at what cost could we move to another provider?
If the answers are vague, that tells you something too.
Sovereignty has a price
I’d be misleading you if I said the answer is always “go sovereign.” Locally controlled clouds can cost more, and the biggest providers often have better tools and wider service ranges. Many companies will rightly keep most workloads on mainstream platforms. A sensible approach is risk-based: classify your data, keep the most sensitive information, such as health records, financial data, government contracts and trade secrets, under tighter control, and let ordinary workloads run where they’re cheapest and best.
The bottom line
Not long ago, “where is our data?” was a question for the IT department. Now it belongs in the boardroom, next to questions about suppliers, insurance and reputation. You don’t need to rip out your cloud strategy. You do need to know where your data sits, who can reach it and how you’d leave if you had to. Companies that can answer those three questions calmly will have an easier time with regulators, customers and the next surprise.