Featured

Blogs

Data sovereignty starts with control: not just over databases, but over the data itself

Steven Maas, Data Security Expert at Thales

08 May 2026

Over the past ten years, trust in hyperscalers has grown rapidly. Many organizations have moved to the cloud. Hyperscalers offered scale, innovation, and security. Their infrastructure was robust, compliance well organized, and security measures impressive. For a long time, there was a belief that data was automatically safe once it was stored with a large cloud provider. That assumption is increasingly being challenged—not because the cloud is insecure, but because organizations are realizing that security and sovereignty do not automatically arise from outsourcing.

Control is more important than location
The discussion around data sovereignty often focuses on location: is our data stored in Europe and does it comply with local regulations? But physical location alone says little about real control. Even when data is stored nearby in the cloud, it can still be accessed through technical backdoors, legal channels, or human error. Data sovereignty is therefore not about where data resides, but about who can access it—and more importantly, who cannot.

Sovereignty means control. Control over who can see data, who can enforce access, and who manages the keys. The objective is simple: whether data is stolen or formally requested, unauthorized parties must not be able to use it. In both cases, the core issue is the same: confidentiality.

Using the cloud without losing control
For many organizations, the challenge lies in finding the right balance. The benefits of cloud technology are significant: scalability, flexibility, and innovation. At the same time, compliance requirements are increasing and the pressure to better protect sensitive data is growing. In practice, we see organizations reassessing their cloud strategies. The question is no longer whether data can move to the cloud, but how to leverage its benefits without losing control over sensitive information. This requires a different approach to data sovereignty—not as a destination, but as an ongoing process where technology, governance, and organization come together.

Why cloud providers should not have access either
Cloud providers have become indispensable in the digital economy. However, this does not mean they should automatically have access to sensitive data. True data sovereignty requires that organizations manage their own encryption keys and determine who can decrypt data. The guiding principle is increasingly: zero access by default—no one has access unless it is explicitly and temporarily granted.
By managing encryption keys outside the cloud environment, organizations can prevent foreign legislation, legal procedures, or commercial interests from influencing their data. The cloud provider can deliver infrastructure and process data, but does not have access to its contents.

Encryption as the foundation of sovereignty
It is therefore essential for organizations to choose a model in which they retain full control of their keys. There are several levels of control:

Native encryption – the cloud provider manages both infrastructure and keys;
Bring Your Own Key (BYOK) – the organization creates the key, but it is stored with the cloud provider;
Hold Your Own Key (HYOK) – the encryption key remains entirely outside the cloud environment;
Bring Your Own Encryption (BYOE) – data is encrypted before it is sent to the cloud.

The further an organization progresses along these models, the greater the control over its own data. In particular, the principle where the key remains completely outside the cloud provider is increasingly seen as an important and practical building block for digital sovereignty.

Trust as the ultimate goal
The discussion around digital sovereignty is often framed in terms of technology or geopolitics. In reality, it is about trust. Organizations must be able to trust that sensitive information remains protected, regardless of where it is stored or processed. That trust does not come from simply relocating data, but from establishing control.
By managing their own keys, implementing clear governance, and making conscious choices about cloud usage, organizations can benefit from modern infrastructure without losing their autonomy. Data sovereignty therefore does not begin in the cloud, but with control—control over data, access, and the keys that determine who can actually read the information. Only then does the cloud become a tool for innovation rather than a source of dependency.

Latest blogs

View all blogs

Featured

Blogs