- Digital sovereignty is the ability of a State, an organisation or an individual to control its infrastructure, its data and its technological dependencies.
- It cannot be reduced to a provider's nationality: it combines at least six dimensions, namely jurisdiction, immunity to foreign laws, technology, data, certifications and openness.
- The European Union has made it a central policy theme since 2019, with GAIA-X, the DMA, the Data Act, the EUCS (in progress) and the Cloud Sovereignty Framework announced in 2025.
- For an organisation, digital sovereignty is a dynamic posture, to be measured, managed and strengthened over time.
What are we talking about?
Digital sovereignty refers to the ability of an actor (a State, an organisation, an individual) to decide autonomously how its digital infrastructure is used, to protect its data and to remain in control of its technology choices over time. The term is defined in contrast to situations of imposed dependency: foreign regulatory pressure, proprietary lock-in, geopolitical unavailability of a service.
Public debate often confuses sovereignty with nationality. A service hosted in France can be controlled from abroad through its ownership structure. Conversely, a service operated by the European subsidiary of a non-European group can offer strong contractual guarantees. It is the combination of dimensions, not the flag alone, that determines the actual sovereign posture.
For an organisation, digital sovereignty is therefore an ongoing process. It is measured (mapping of dependencies), managed (governance of procurement and architecture) and strengthened (tested reversibility, progress in certification).
The 6 dimensions of NextHop scoring
Each dimension answers a concrete question. Combined, they provide a stable reading that can be compared from one provider to another.
Jurisdiction
The law governing the contract, the operating entity and the parent company. It determines which authorities can issue orders concerning the service and its data.
Immunity
The service's ability to withstand extraterritorial laws (CLOUD Act, FISA 702, secondary sanctions). This includes the identity of shareholders and the internal organisation.
Technology
The degree of autonomy across the technical chain: hardware, hypervisor, key management, monitoring. The more the stack is controlled, the lower the dependency.
Data
The physical location of primary data, replicas, logs and metadata. Without a clear data flow diagram, the advertised residency cannot be verified.
Certifications
Qualifications suited to the level of sensitivity: ISO 27001 as the baseline, HDS for health, SecNumCloud for sensitive government data, and tomorrow EUCS for Europe.
Openness
Reversibility, open formats and the absence of proprietary lock-in. This guarantees the ability to leave, and therefore freedom of choice over time.
European policy, step by step
- October 2019The French and German economy ministers announce the GAIA-X project, which aims to federate a European cloud infrastructure around common standards.
- December 2020The European Commission presents the Digital Markets Act and the Digital Services Act. Adopted in 2022, they have applied progressively since 2023.
- May 2021French “cloud au centre” (cloud first) doctrine, which makes SecNumCloud mandatory for sensitive government data.
- 2022-2024ENISA work on the European Cybersecurity Certification Scheme for Cloud Services (EUCS). The High level is the focus of the debate on immunity to extraterritorial laws.
- January 2024The Data Act begins to apply progressively. It facilitates data portability between providers and regulates exit costs.
- June 2025The European Commission announces a Cloud Sovereignty Framework, which structures requirements for European public procurement.
Institutional voices to follow
ANSSI
French national agency; operates SecNumCloud and publishes the reference technical doctrine.
ENISA
European cybersecurity agency; leads the work on the future EUCS scheme.
European Commission, DG CNECT
Conducts EU digital policy: Data Act, EUCS, Cloud Sovereignty Framework.
DINUM
French interministerial digital directorate; operates the cloud au centre doctrine.
Cigref
Network of large companies and public administrations. Regular publications on sovereignty requirements.
Five questions to clarify
What is digital sovereignty?
It is the ability of an actor (a State, an organisation, an individual) to decide autonomously how its digital infrastructure is used, to protect its data and to remain in control of its technology choices over time.
Are digital sovereignty and nationality the same thing?
No. A provider's nationality is not enough to guarantee sovereignty. A service hosted in France can be controlled from abroad through its ownership structure. Conversely, the European subsidiary of a non-European group can offer strong guarantees depending on how it is organised.
What are the 6 dimensions of NextHop scoring?
Jurisdiction (applicable law), Immunity (resistance to extraterritorial laws), Technology (autonomy of the stack), Data (actual location), Certifications (independent qualifications), Openness (reversibility and standards). Full details are public on the Methodology page.
Why has Europe talked about it so much since 2019?
Several triggers converge: post-Snowden awareness, dependency on US hyperscalers exposed during the pandemic, rising geopolitical tensions, and the political will to organise a coordinated response. GAIA-X (2019), the DMA, the Data Act and the EUCS shape this momentum.
How can an organisation's digital sovereignty be measured?
Through a mapping of dependencies (providers, services, data), a legal audit of contracts and a review of architecture choices. NextHop offers in-depth independent audits on request.
Further reading
- EU digital strategy, overview (digital-strategy.ec.europa.eu)
- GAIA-X Association, project overview (gaia-x.eu)
- ANSSI, doctrine and frameworks (cyber.gouv.fr)
- ENISA, EUCS Candidate Scheme draft
- Data Act Regulation (EU) 2023/2854 (eur-lex.europa.eu)
- Digital Markets Act (EU) 2022/1925 (eur-lex.europa.eu)
- Cigref, publications on digital sovereignty (cigref.fr)