Encryption is often suggested as a way to address data sovereignty because the customer holds the key to protect data in motion, in use, and at rest. However, Buest noted, most regulators have not explicitly approved the use of encryption or other security measures or deemed them sufficient for compliance.
There may soon be a development here, however. In fall 2025, the European Commission released The Cloud Sovereignty Framework (CSF), a mandatory reference document for procuring cloud services in the EU. The goal is to ensure that cloud services used in the EU are under European control and shielded from other countries’ laws (such as the US Cloud Act). The Commission is defining a set of ‘sovereignty objectives’ to clearly define what sovereignty means, Buest said.
This framework has the potential to serve as an “official blueprint and guideline” for government bodies and decision-makers in enterprises beyond Europe, she noted.
Forrester’s Maisto agreed that, as of yet, there is no GDPR for sovereignty and “no legislation whatsoever in the world tells us what sovereignty is and isn’t.”
Overall, he described a “fundamental trade-off” between sovereignty and functionality: Where one increases, the other decreases, and vice-versa. For instance, sovereign private clouds and air-gapped solutions are “not vaguely on par” with their public cloud twin offerings.
For instance, a sovereign cloud might offer basic object storage and compute, but lack advanced serverless functions or proprietary AI-orchestration tools found in a global AWS or Azure region.
