In brief
Definition
What are we talking about?
Digital sovereignty describes the ability of an actor (state, organisation, individual) to autonomously decide on the use of its digital infrastructure, to protect its data and to retain control over its technological choices over time. The term is built in opposition to situations of imposed dependency: foreign regulatory pressure, proprietary lock-in, geopolitical unavailability of a service.
The public debate often conflates sovereignty and nationality. A service hosted in France may be controlled from abroad via the capital chain. Conversely, a service operated by a European subsidiary of a non-European group may benefit from strong contractual guarantees. It is the combination of dimensions, not the simple flag, that determines the real sovereign posture.
For an organisation, digital sovereignty is therefore a continuous process. It is measured (dependency mapping), steered (procurement and architecture governance) and strengthened (tested reversibility, increased certification).
Analytical framework
The 6 dimensions of the NextHop scoring
Each dimension answers a concrete question. Combined, they form a stable reading, comparable from one provider to another.
Jurisdiction
The law applicable to the contract, the operating entity and the parent company. Determines which authorities may issue injunctions over the service and its data.
Immunity
The service's ability to resist extraterritorial laws (CLOUD Act, FISA 702, secondary sanctions). Includes shareholder identity and internal organisation.
Technology
The degree of autonomy over the technical chain: hardware, hypervisor, key management, monitoring. The more the stack is mastered, the lower the dependency.
Data
The physical location of primary data, replicas, logs and metadata. Without a clear flow schema, the advertised residency is not verifiable.
Certifications
Qualifications matching the sensitivity level: ISO 27001 as the baseline, HDS for health, SecNumCloud for sensitive state data, EUCS tomorrow for Europe.
Openness
Reversibility, open formats and absence of proprietary lock-in. Guarantees the ability to leave, hence freedom of choice over time.
Timeline
European policy, step by step
Actors
Institutional voices to follow
ANSSI
French national agency, operates SecNumCloud and publishes the reference technical doctrine.
ENISA
European cybersecurity agency, leads the work on the future EUCS scheme.
European Commission, DG CNECT
Drives EU digital policy: Data Act, EUCS, Cloud Sovereignty Framework.
DINUM
French interministerial digital directorate, runs the cloud-au-centre doctrine.
Cigref
Network of large companies and public administrations. Regular publications on sovereign requirements.
Frequently asked
Five questions to clarify
What is digital sovereignty?
It is the ability of an actor (state, organisation, individual) to autonomously decide on the use of its digital infrastructure, to protect its data and to retain control over its technological choices over time.
Are digital sovereignty and nationality the same thing?
No. The nationality of a provider does not suffice to guarantee sovereignty. A service hosted in France may be controlled from abroad via the capital chain. Conversely, a European subsidiary of a non-European group can offer strong guarantees depending on its organisation.
What are the 6 dimensions of the NextHop scoring?
Jurisdiction (applicable law), Immunity (resistance to extraterritorial laws), Technology (autonomy of the stack), Data (effective location), Certifications (independent qualifications), Openness (reversibility and standards). Details are public on the Methodology page.
Why has Europe been talking about this so much since 2019?
Several triggers converge: post-Snowden awareness, dependency on US hyperscalers revealed during the pandemic, rising geopolitical tensions, and political will to organise a coordinated response. GAIA-X (2019), DMA, Data Act and EUCS structure this dynamic.
How to measure the digital sovereignty of an organisation?
Through a mapping of dependencies (providers, services, data), a legal audit of contracts and a review of architectural choices. NextHop offers a quick self-assessment at /auto-evaluation and in-depth independent audits on request.
Sources and references
Further reading
On NextHop