What is digital sovereignty?
Digital sovereignty is the ability of a country or region to control and protect its data, infrastructure and digital systems under its own laws. In practice, it means retaining control over who can access data, where it is handled and which legal framework applies.
In the cloud, however, this becomes more complex because data and services are often distributed across regions and managed by global providers.
To add, sovereignty represents a spectrum of considerations spanning data, technical, geopolitical and operational dimensions.
Data residency vs Data sovereignty
Data sovereignty starts with control over where data is stored and processed. Not only the physical location, but also ensuring data remains subject to the intended legal jurisdiction, supporting ownership, compliance, and protection of sensitive information.
This highlights an important distinction:
- Data residency: where data is stored.
- Data sovereignty: which laws apply to that data.
As a result, storing data in a European cloud region does not automatically remove cross-border legal considerations.
Digital sovereignty also includes:
- Access and control: who can access your data, under which conditions and how that access is monitored.
- Operational control: your ability to keep systems running and recover from disruption.
- Technical sovereignty: control over your architecture, portability and dependency on specific technologies.
- Geopolitical sovereignty: exposure to foreign legislation, providers and political decisions.
The legal challenge for European organisations
U.S. Regulations with Extraterritorial Reach
The US CLOUD Act can require American companies to provide data under certain circumstances, even when that data is stored in Europe. Microsoft has said it would challenge inappropriate requests, limit disclosure where possible and inform customers when permitted.
A recent hearing in the French Senate highlighted this tension between European data residency and US jurisdiction.
Other US laws, including the Patriot Act and FISA Section 702, add to these concerns. The key issue is that data stored in Europe can still fall under foreign legal pressure when the provider itself is subject to US law.
European Counterweights
Europe has introduced several measures to strengthen privacy and sovereignty:
- GDPR: restricts the transfer of personal data outside the EU.
- E-Evidence Regulation: provides a European framework for requesting digital evidence.
- EU Cloud Sovereignty Framework: assesses cloud services on factors such as exposure to foreign law and operational independence.
In addition, several countries, such as the Netherlands, have passed national security and computer crime laws that control how their own authorities can access data. However, these measures do not fully remove the legal risk for organisations using US cloud providers.
How Microsoft supports digital sovereignty in Azure
Shared Responsibility
Sovereignty in Azure is not a product you buy; it is a partnership, defined by the Shared Responsibility Model.
- Microsoft is responsible for the security of the cloud (the physical data centres, the network and the underlying infrastructure).
- You are responsible for security within the cloud (your data, who has access to it, and how you configure the available tools).
- Microsoft provides the tools. It’s up to you to configure and use them properly.
How Azure helps protecting your data:
- You Choose the Region: Azure is divided into ‘Regions’. Microsoft allows you to choose where supported workloads and data are deployed, for example West Europe in the Netherlands.
- The EU Data Boundary: This keeps customer data, as well as most technical log and support data, processed and stored within EU boundaries.
- Guardrails and policies: Azure Policy lets you restrict where resources can be deployed. For example, you can block deployments outside approved European regions. The Sovereign Landing Zone (SLZ) adds ready-to-use policy baselines that can:
- Enforce EU-only regions.
- Block non-regional services by default.
- Require Private Link and customer-managed keys.
How Azure helps prevent unauthorised access
- RBAC: Role-Based Access Control (RBAC) defines what each user is allowed to do, for example read data without being able to change it.
- PIM: Privileged Identity Management (PIM) reduces permanent administrator access by allowing elevated permissions to be activated only when needed.
- Conditional Access: Access can depend on factors such as location, device or network, with extra verification or blocking where required.
- Customer Lockbox: Microsoft’s recently introduced Customer Lockbox gives customers explicit approval control before Microsoft support engineers can access customer content. If support access is needed, the request must be approved first. This adds an extra governance layer and strengthens transparency and accountability around sensitive data access.
How Azure helps you lock the safe from the inside
If data is properly encrypted, it is unreadable without the key.
- Azure Key Vault Premium HSMs: Lets you encrypt data and manage keys using hardware-backed Hardware Security Modules (HSMs). This gives you stronger control over sensitive data and reduces the risk of external access.
- Azure Key Vault: Securely stores secrets such as passwords, certificates and encryption keys.
- Manage the keys yourself (CMK/BYOK): With Customer Managed Keys (CMK), also known as Bring Your Own Key (BYOK), you generate and manage the keys yourself. If you revoke a key, access to the encrypted data is removed.
- Managed HSM: For stricter requirements, a Managed Hardware Security Module (HSM) gives you control over the Security Domain, keeping key management further separated from Microsoft.
- In-use protection with Confidential Computing: Data is protected at rest and in transit, but Confidential Computing also protects it while being processed in memory by isolating it from the wider system.
The legal limits of sovereignty
Despite these technical measures, the legal reality of the US CLOUD Act remains. Microsoft is still an American company and therefore falls under US jurisdiction, even when your data is hosted in the Netherlands. This creates a residual legal risk that technical controls cannot fully remove.
However, technical sovereignty can significantly reduce that exposure. If you manage your own encryption keys and use controls such as Confidential Computing, it becomes technically impossible for Microsoft to give others readable access to your data.
The benefits of staying in Microsoft Cloud
Despite these legal concerns, Azure remains a strategic choice for many organisations. Sovereignty matters, but so do security, resilience, scale, innovation and operational maturity.
Security and compliance by design
Microsoft invests heavily in cloud security and compliance. Azure benefits from the large volume of security signals Microsoft processes across its services and includes technologies such as Purview, Advanced Threat Protection and several encryption options.
For organisations dealing with strict customer requirements or regulatory pressure, these built-in capabilities can be difficult to reproduce independently.
Innovation and AI
Azure also provides access to a broad portfolio of managed services, including advanced AI capabilities. Moving away from Azure entirely may give you more control in one area, but it can also limit access to services that help development teams build and release new functionality faster.
Scalability
Azure operates at a scale many smaller European providers cannot match, including more than 100 data centres across Europe. That supports high availability, redundancy and multi-region architectures. Restricting workloads to one region, one local environment or one smaller provider may improve sovereignty, but it can also reduce redundancy.
Large ecosystem
Azure also has a large ecosystem of partners, tools, expertise and proven implementation experience. For many organisations, that operational maturity and access to specialist knowledge can be difficult to give up.
Global cloud platforms such as Azure are built for high availability and resilience through distributed infrastructure and redundancy. Limiting workloads to specific regions or isolated environments can reduce some of these advantages.
Azure also offers a wide range of innovative Azure AI services. Moving away from Azure entirely could limit an organization’s ability to innovate.
The downside of leaving Microsoft Cloud
Greater sovereignty does not automatically mean that every workload should move to a European provider.
Moving away from Azure can reduce dependency on an American cloud provider, but it can also introduce new trade-offs:
- Less access to managed services and AI capabilities.
- More operational responsibility for your own teams.
- Reduced built-in resilience and high availability.
- Higher costs or more complex management.
- A smaller ecosystem of available expertise and tooling.
In certain cases, such as government bodies or organisations handling highly sensitive data, these requirements leave little room for compromise. For others, a more selective approach makes more sense.
Which sovereignty model fits your data?
Not every workload requires the same level of sovereignty.
- General business data: Azure or Microsoft 365 in EU regions may be sufficient when sensitivity is low to medium and collaboration is important.
- Critical IP or state-sensitive data: Higher-sensitivity workloads may need stronger controls, such as Azure Local or a more tightly governed public cloud setup.
- Regulated workloads: Some organisations may require stricter hosting, access or jurisdiction controls. Depending on the requirements, Azure Local, a national partner cloud or another controlled environment may be appropriate.
