Understanding cloud sovereignty in Europe
Extraterritorial laws, certifications, European initiatives and sector obligations: sourced guides to understand what really protects your data, and what does not.
Hosting your data in Europe is not enough to protect it. A provider subject to US law can be compelled to hand it over, wherever it is stored; conversely, qualifications such as SecNumCloud require verified legal immunity. These guides explain the texts, their real scope and the practical levers available to you.
Each guide cites its primary sources (legislation, court rulings, official frameworks) and links to the observatory's data: provider profiles, comparison tool and scoring methodology.
- Primary sources cited
- Independent analysis
- Linked to the observatory's data
The fundamentals
The basic concepts behind cloud sovereignty.
Digital sovereignty
The ability to control one's infrastructure, data and technological dependencies, read across six dimensions.
Read the guide Cloud marketHyperscalers
AWS, Azure and GCP account for around two thirds of the global cloud market: footprint, dependencies and alternatives.
Read the guide LexiconGlossary
More than 60 cloud sovereignty terms defined: legal frameworks, certifications, technologies and players.
Read the guideExtraterritorial laws
The US laws that give access to data hosted in Europe, and the response of the EU Court of Justice.
CLOUD Act
The 2018 law that allows US authorities to demand data stored outside the United States.
Read the guide US law · 2008FISA Section 702
The FISA section that allows US intelligence to target, through US providers, the communications of non-US persons abroad.
Read the guide CJEU ruling · 2020Schrems II
The CJEU ruling that invalidated the Privacy Shield and requires a case-by-case assessment of any data transfer to the United States.
Read the guideEuropean regulations and certifications
The obligations, qualifications and initiatives that frame a trusted cloud.
NIS 2
The directive that imposes cybersecurity measures and incident reporting on thousands of essential and important entities, cloud providers included.
Read the guide ANSSI qualification · 2016SecNumCloud
ANSSI’s cloud security qualification: a demanding technical baseline that does not, on its own, neutralise US law.
Read the guide European certification · ENISAEUCS
The future European cybersecurity certification scheme for cloud services, and the debate over sovereignty at its High level.
Read the guide European initiative · 2019GAIA-X
The Franco-German association that defines common rules, labels and data spaces for a federated European cloud.
Read the guideSovereign cloud by sector
Obligations and sound choices for your sector.
Public sector
Cloud au Centre doctrine, SecNumCloud, GDPR and NIS2: the framework applicable to government departments, local authorities and operators of vital importance.
Read the guide Sector · DORAFinance and insurance
DORA, EBA, ACPR, MiFID II: the digital operational resilience framework for banks, insurers and fintechs.
Read the guide Sector · HDSHealthcare
HDS, GDPR article 9, SNDS, EHDS: the key points for hosting health data in the cloud.
Read the guide