Contact 
As geopolitical tensions increase and data becomes one of the world’s most valuable strategic assets, UK organisations are being forced to ask a difficult question: who really controls their data, systems and critical digital services?
For many UK businesses, public sector bodies and operators of critical national infrastructure, the answer may be uncomfortable.
Over the last two decades, UK organisations have embraced cloud services from Microsoft, Google, Amazon, Salesforce and other US technology providers. While these platforms have delivered innovation, scalability and cost savings, they have also created a level of dependency that raises serious questions about sovereignty, resilience, procurement risk and regulatory control.
Today, digital sovereignty is no longer a niche concern for defence, intelligence and central government. It is rapidly becoming a board-level issue for any UK organisation responsible for sensitive data, critical infrastructure, public services or regulated operations.
What Is Digital Sovereignty?
Digital sovereignty refers to an organisation’s ability to retain meaningful control over its data, technology infrastructure and digital operations without being unduly exposed to the laws, political decisions or commercial interests of a foreign nation.
In practical terms, it means:
- Knowing where data is stored.
- Understanding which legal jurisdictions apply.
- Maintaining control over access to information.
- Reducing dependency on a single foreign provider.
- Ensuring business continuity if geopolitical circumstances change.
As more UK services move to the cloud, sovereignty becomes increasingly difficult to achieve, particularly when infrastructure is owned by organisations headquartered outside the UK.
The UK Risk: Cloud Dependence and Critical Services
The global cloud market is heavily concentrated among a small number of American hyperscalers, primarily Amazon Web Services (AWS), Microsoft Azure and Google Cloud. For the UK, this creates a practical challenge: many critical services, regulated businesses and public sector systems now rely on platforms that are commercially and legally controlled outside the UK.
While these platforms operate UK data centres and can support UK data residency requirements, the physical location of data is only part of the equation.
The more significant issue is legal jurisdiction.
Many organisations assume that storing data in a UK region means only UK laws and operational controls apply. In reality, the position is more complex, particularly where the parent company, support functions, administrative access or legal obligations sit outside the UK.
UK Policy Context
The UK has not taken the same centralised sovereignty approach as the European Union, but it has produced strong guidance on secure cloud adoption, public sector procurement and risk-based assurance. The UK Government’s public sector cloud guidance recognises that cloud can improve speed, security and innovation. It also highlights the need to consider supplier lock-in, commercial exposure, security, operational resilience and workforce capability when developing cloud strategy.
The National Cyber Security Centre also provides cloud security guidance and cloud security principles to help UK organisations choose, configure and use cloud services securely. These principles cover data protection, asset resilience, customer separation, governance, operational security and supply chain risk.
For UK organisations, the sovereignty discussion should therefore be framed as a risk management issue rather than a simple question of whether cloud is good or bad. The key question is whether the organisation has enough control, resilience and legal assurance for the sensitivity of the workload.
The CLOUD Act and Extraterritorial Reach
In 2018, the United States enacted the Clarifying Lawful Overseas Use of Data (CLOUD) Act. The legislation allows US authorities to require American technology companies to provide access to data under their “possession, custody or control”. This applies regardless of where the data is physically stored.
The legislation followed the well-known Microsoft Ireland case. US authorities sought access to emails stored in a Microsoft data centre in Dublin. Microsoft initially challenged the request. The CLOUD Act later clarified that US providers could be required to disclose overseas data under certain legal processes.
This means data held in a European data centre may still be subject to lawful requests directed at the American parent company.
For UK organisations handling sensitive information, this creates a difficult governance challenge. Even if data never leaves the UK or Europe, control over that data may not be entirely local if the provider is subject to overseas legal authority.
Why UK Boards and Public Sector Leaders Should Be Concerned
For the UK, the debate extends beyond privacy. It touches national security, economic resilience, public service continuity, operational dependency and the ability to make sovereign decisions during crises.
The debate extends beyond privacy. It touches national security, economic resilience and geopolitical influence.
UK organisations should treat digital infrastructure as a strategic capability, comparable to energy, telecommunications and transport. This is particularly important for government departments, local authorities, healthcare, financial services, defence suppliers and operators of critical national infrastructure.
The concern is straightforward:
- What happens if diplomatic relationships deteriorate?
- What happens if export controls restrict technology access?
- What happens if a foreign government can influence access to critical systems?
- What happens if a single supplier becomes too commercially or operationally embedded to replace?
- What happens if a critical public service depends on infrastructure outside UK control?
These are no longer hypothetical questions.
Lessons from Recent Geopolitical Events
The conflict in Ukraine, increasing US-China technology tensions and growing global sanctions regimes have demonstrated how quickly access to technology and digital services can become a geopolitical issue.
For the UK, this highlights the need to understand cyber risk, supplier dependency, legal jurisdiction and operational resilience.
In May 2026, NL Times reported that Microsoft had been accused of sharing the names of Dutch civil servants with the US House of Representatives. The officials reportedly worked for the Authority for Consumers and Markets and the Dutch Data Protection Authority. They were involved in implementing the EU Digital Services Act. The report stated that emails, meeting invitations and minutes were shared without the officials’ names being redacted. Dutch ministers described the allegations as concerning and linked them to wider concerns about reliance on American technology providers and the US CLOUD Act.
There is no evidence of widespread misuse of the CLOUD Act against allied nations. However, the legislation demonstrates that legal authority can extend beyond national borders when providers are headquartered elsewhere. This has become a key argument behind Europe’s digital sovereignty movement. It is also becoming increasingly relevant to UK procurement, governance and risk management discussions.
What the EU Has Done to Combat This
The European Union has taken a more explicit policy-led approach to digital sovereignty. Its response has focused on reducing strategic dependence on non-European providers, improving legal and operational control, and creating common frameworks for trusted cloud services.
Gaia-X
One of the most prominent initiatives is Gaia-X, a European initiative to create a federated, trusted and interoperable data ecosystem. The objective is not necessarily to replace existing cloud providers, but to provide governance frameworks that improve transparency, portability and control over data in line with European rules and values.
Sovereign Cloud Platforms
Several European countries and EU institutions have also supported sovereign cloud initiatives, including:
- France’s “Cloud de Confiance” model, which aims to provide trusted cloud services under French and European control.
- Germany’s sovereign cloud programmes’, which focus on national resilience and reduced dependency on foreign control points.
- The European Commission’s Cloud Sovereignty Framework, which sets sovereignty objectives covering legal, operational, supply chain, security and compliance considerations.
- EU-backed procurement and assurance mechanisms designed to encourage cloud services that meet European sovereignty requirements.
Hybrid and Multi-Cloud Strategies
Many UK organisations are likely to take a pragmatic route by adopting:
- Multi-cloud architectures to avoid over-dependence on a single supplier.
- Hybrid cloud environments that keep the most sensitive workloads under tighter operational control.
- Data classification strategies that distinguish routine workloads from nationally or commercially sensitive data.
- Sovereignty-aware procurement processes that assess legal jurisdiction, support access, subcontractors, exit plans and concentration risk.
- Regular resilience testing to understand how services would continue if a supplier, region or geopolitical relationship became disrupted.
Rather than abandoning large hyperscalers entirely, UK organisations can identify critical workloads and ensure they remain under appropriate jurisdictional, contractual and operational control.
What UK Organisations Should Do Next
Digital sovereignty is not about rejecting innovation or abandoning cloud technology. Nor is it about creating national silos disconnected from the global internet.
For UK organisations, it’s about making informed technology decisions that balance innovation, cost, security, resilience, legal exposure and operational control.
The question is no longer whether cloud services are secure. For many organisations, it is whether they remain in control when security, law, politics, procurement and geopolitics intersect.
As UK regulators, public sector bodies and enterprises continue to assess strategic technology dependencies, digital sovereignty will become a defining issue for the next generation of cybersecurity, procurement and risk management.
Those who address it today will be better positioned to protect critical services, reduce supplier risk and navigate an increasingly uncertain digital landscape.
