Introduction

For over a decade, sovereignty has been a central issue for companies and governments, regardless of the country or region. With the rise of Cloud technologies, changes in legislation in different countries and regions, the rapid adoption of AI technologies and a geopolitical situation that is becoming much more complex and unstable, this issue needs to be taken into account by all organisations, depending on their context and the issues at stake.

Technologies are increasingly perceived in terms of their origins, from hardware (processor, disk, memory, network card, 5G modem, etc.) to software (operating system, ERP, etc.) and now even algorithms that assert their bias. Depending on our needs, the meaning and need for independence are clearly different.

A lot of thinking is going on in Europe, and we tend to think that we are the only ones asking questions about this subject. However, many countries and regions are introducing legislation to defend their economic interests and independence.

The state of sovereignty in different countries:

China

Personal Data Protection: Strict regulations through the Personal Information Protection Law (2021) ensuring individual data protection and heavy penalties for breaches.
Data Localisation: Enforces mandatory localisation via Cybersecurity Law (2017) and Data Security Law (2021).
Know-How Protection: Protection of national tech under the State Secrets Law (2024). Focus on minimising exposure to foreign tech.
Protection Against Third-Party Technologies: Promotes domestic tech via initiatives like Domestic Semiconductor Industry (2024) and tightly controls foreign tech integration.

United States

Personal Data Protection: State-dependent policies; federal efforts include California Consumer Privacy Act (CCPA) and other state laws for personal data protection.
Data Localisation: “No mandatory localisation laws, but encourages domestic hosting for sensitive sectors like defense.”
Know-How Protection: “Protects know-how via intellectual property laws, fostering innovation in private sectors.”
Protection Against Third-Party Technologies: “Reliance on tech giants like Google and Microsoft but scrutiny over foreign entities like TikTok.”

France

Personal Data Protection: “Enforces EU-wide regulations like GDPR, with additional national vigilance for critical data.”
Data Localisation: “Advocates for localisation for strategic sectors via frameworks like ANSSI.”
Know-How Protection: “High focus on industrial and R&D protection via national defense mechanisms.”
Protection Against Third-Party Technologies: “Leverages European sovereignty frameworks such as Gaia-X to reduce dependence on non-European solutions.”

Europe

Personal Data Protection: “Unified under GDPR, ensuring strict personal data protection and cross-border data transfer rules.”
Data Localisation: “Promotes data localisation via projects like Gaia-X and Digital Services Act.”
Know-How Protection: “Emphasises collective protection of strategic sectors through policies like Digital Markets Act.”
Protection Against Third-Party Technologies: “Ongoing legislative measures, including Regulation of Foreign Technology (2024), to scrutinise foreign tech influence.”

Morocco

Personal Data Protection: Personal Data Protection Law (2009) under CNDP ensures basic individual data safeguards but lacks stringent GDPR-level implementation.
Data Localisation: “Encourages local hosting for certain sensitive data but no comprehensive localisation mandate.”
Know-How Protection: “Initiatives exist to protect industrial and cultural heritage, though enforcement is developing.”
Protection Against Third-Party Technologies: “Dependence on foreign tech with growing interest in bolstering local ecosystems via partnerships.”

India

Personal Data Protection: Personal Data Protection Act (2023) enhances user data safeguards with stricter classification and access rules.
Data Localisation: “Mandates data localisation for critical sectors like banking under Data Protection Bill.”
Know-How Protection: “Strong emphasis on protecting digital and industrial know-how, especially in strategic sectors.”
Protection Against Third-Party Technologies: “Encourages domestic tech production via Atmanirbhar Bharat (Self-Reliant India) while balancing foreign investments.”

Japan

Personal Data Protection: “Comprehensive data protection under APPI (Act on Protection of Personal Information), with strict requirements for private and public sectors.”
Data Localisation: “No explicit localisation mandate but strict rules for cross-border data transfers to ensure equivalency.”
Know-How Protection: “Strong R&D and industrial know-how protection through partnerships with tech companies and regulatory safeguards.”
Protection Against Third-Party Technologies: “Heavy reliance on domestic tech giants like Sony and Fujitsu, combined with scrutiny over foreign entities.”

European Union (EU) has progressively developed its approach to digital sovereignty, aiming to assert control over its digital infrastructure, data, and technological development.
The EU’s pursuit of digital sovereignty gained prominence in the late 2010s, driven by concerns over dependence on non-European technologies and the need to uphold European values in the digital realm.
The EU faces challenges balancing regulation with fostering innovation, addressing dependencies on foreign technologies, and ensuring member states’ alignment with EU-wide digital policies. Ongoing efforts include investing in AI, cybersecurity, and sustainable digital infrastructures to strengthen Europe’s position in the global digital landscape.

China‘s approach to digital sovereignty, often termed “cyber sovereignty,” emphasises state control over digital infrastructure, data, and internet content within its borders. This strategy reflects the government’s commitment to maintaining national security, political stability, and cultural integrity in the digital realm.
China actively promotes its concept of cyber sovereignty on the global stage, advocating for each nation’s right to regulate its own internet space without external interference. This stance has influenced other countries seeking to enhance state control over digital activities, contributing to a broader trend towards digital sovereignty worldwide.

For the United States, digital sovereignty has evolved significantly, reflecting the nation’s efforts to control and secure its digital infrastructure and data.
Historically, the U.S. has prioritised an open and global internet, promoting free data flows and minimal restrictions. However, revelations such as the NSA’s PRISM program in 2013 highlighted extensive data collection practices, prompting domestic and international concerns about data sovereignty.
The U.S. continues to face challenges in balancing national security with economic interests and civil liberties. The rise of artificial intelligence and emerging technologies presents new considerations for digital sovereignty, requiring ongoing policy adaptation to address evolving threats and maintain technological leadership.

The ecosystem of solutions is expanding strongly in Europe to meet these challenges

To meet these new challenges, the ecosystem of solutions has been expanding in Europe in recent years.

OVHcloud: A European leader in cloud services, OVHcloud offers sovereign cloud solutions in France and Europe, ensuring data protection in compliance with local regulations.
Scaleway: A subsidiary of the Iliad Group, Scaleway provides cloud computing services with infrastructure located in France, adhering to data sovereignty requirements.
Outscale: A Dassault Systèmes subsidiary, Outscale delivers certified sovereign cloud services tailored to the security and compliance needs of businesses and government agencies.
Bleu: A joint venture between Orange and Capgemini, Bleu aims to offer a French alternative to international solutions, independent of extraterritorial laws, mirroring Azure services.
S3NS: A partnership between Thales and Google, S3NS provides secure cloud services designed to meet digital sovereignty requirements.
Cloud Temple: A subsidiary of the French IT services company Neurones, Cloud Temple operates entirely in France. It offers secure cloud services based on a redundant infrastructure spread across three data centres in the country.
STACKIT: A subsidiary of the Schwarz Group, STACKIT provides cloud and colocation services, offering a sovereign storage solution for Google Workspace customers, with infrastructure based in Germany, Austria, and Switzerland.
LuxConnect: A Luxembourg-based company operating multiple data centres and a fibre-optic network. LuxConnect offers sovereign cloud solutions that are compliant with European data protection standards.
Clarence: A joint venture between LuxConnect and Proximus, Clarence delivers a sovereign, decoupled cloud solution, ensuring all operations occur within Europe and are subject only to European jurisdictions.

Challenges

How can companies and public organisations respond to these new challenges?

To do this, each company needs to define what sovereignty means in its own context and identify the areas in which it is concerned. The areas most often considered are

Data sovereignty and localisation
Dependence on technology suppliers
Preservation of their know-how and heritage
Reversibility/ interoperability
Compliance with various international and local regulations
Vulnerability of cyber security and infrastructure
Interoperability and standardisation challenges
Economic impact of the technology gap

Build your own compliance matrix

In conclusion, each company needs to set up a compliance matrix based on its different locations (compliance needs to be analysed by location and technological solution), considering the legal frameworks concerned and the risk exposure based on the technologies made available in each location.

Put forward by Luc Germain, CTO Public Cloud at Devoteam France