# C-Suite, Careers, CIO, Data Center, Data Center Management, Data Governance, Data Integration, Data

Published articles for C-Suite, Careers, CIO, Data Center, Data Center Management, Data Governance, Data Integration, Data.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How to deliver real data sovereignty

DevFeed: [How to deliver real data sovereignty](<https://devfeed.tech/articles/how-to-deliver-real-data-sovereignty-123500.md>)

Original publisher: [Read original article](<https://www.cio.com/article/4241153/how-to-deliver-real-data-sovereignty.html>)

Author: Mary Branscombe

Published: 2026-11-09T10:00:00Z

Content type: article

Language: en

Sources: [CIO](<https://devfeed.tech/sources/cio.md>)

Topics: [digital sovereignty](<https://devfeed.tech/topics/digital-sovereignty.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Confidential Computing](<https://devfeed.tech/topics/confidential-computing.md>), [Shared Responsibility Model](<https://devfeed.tech/topics/shared-responsibility-model.md>), [Data Management](<https://devfeed.tech/topics/data-management.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [c-suite](<https://devfeed.tech/tags/c-suite.md>), [c-suite-careers-cio-data-center-data-center-management-data-governance-data-integration-data](<https://devfeed.tech/tags/c-suite-careers-cio-data-center-data-center-management-data-governance-data-integration-data.md>), [careers](<https://devfeed.tech/tags/careers.md>), [cio](<https://devfeed.tech/tags/cio.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-regions](<https://devfeed.tech/tags/cloud-regions.md>), [confidential-computing](<https://devfeed.tech/tags/confidential-computing.md>), [control](<https://devfeed.tech/tags/control.md>), [costs](<https://devfeed.tech/tags/costs.md>), [customer-data](<https://devfeed.tech/tags/customer-data.md>), [data](<https://devfeed.tech/tags/data.md>), [data-center](<https://devfeed.tech/tags/data-center.md>), [data-center-management](<https://devfeed.tech/tags/data-center-management.md>), [data-governance](<https://devfeed.tech/tags/data-governance.md>), [data-integration](<https://devfeed.tech/tags/data-integration.md>), [data-management](<https://devfeed.tech/tags/data-management.md>), [data-privacy](<https://devfeed.tech/tags/data-privacy.md>), [data-residency](<https://devfeed.tech/tags/data-residency.md>), [data-sovereignty](<https://devfeed.tech/tags/data-sovereignty.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [edition-us](<https://devfeed.tech/tags/edition-us.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [encryption-keys](<https://devfeed.tech/tags/encryption-keys.md>), [eu](<https://devfeed.tech/tags/eu.md>), [europe](<https://devfeed.tech/tags/europe.md>), [google](<https://devfeed.tech/tags/google.md>), [it-leadership](<https://devfeed.tech/tags/it-leadership.md>), [it-management](<https://devfeed.tech/tags/it-management.md>), [it-strategy](<https://devfeed.tech/tags/it-strategy.md>), [language-en](<https://devfeed.tech/tags/language-en.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [operational](<https://devfeed.tech/tags/operational.md>), [oracle](<https://devfeed.tech/tags/oracle.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [security](<https://devfeed.tech/tags/security.md>), [sovereignty](<https://devfeed.tech/tags/sovereignty.md>), [storytype-feature](<https://devfeed.tech/tags/storytype-feature.md>)

### AI overview

Data sovereignty requires control over access and encryption keys, not just EU data residency. Cloud providers offer regional storage, audited support workflows, customer-approved access, and confidential computing, but a US parent company may still face legal demands; customer-managed keys and access controls can reduce provider control while adding staffing and operational costs. Private or disconnected infrastructure offers more control but demands greater ongoing security and maintenance resources. Strict staff-location rules can sharply raise costs and constrain connectivity, collaboration, and resilience. The article recommends setting controls according to each workload's risks and requirements, classifying data and mapping where it flows, then balancing sovereignty with operational needs rather than applying maximum isolation everywhere.

### Source excerpt

Changing where your data is stored isn't enough to deliver sovereignty. You also need to implement the technologies that enforce real control. Local providers are keen to promise alternatives but US ones are making the effort to give customers more options without losing access to the depth of services they offer. Actually turning the promise of sovereign cloud regions into reality means dealing with encryption keys, access workflows and confidential computing, which also means more costs, dependencies, and operational responsibilities. The obvious concern with using US cloud services is the CLOUD Act, which allows the US government to request access to customer data from a US-owned service, even if it's held in the EU. Those requests are supposed to go through the criminal court system. "When it lands in Europe it headbutts with GPDR and you're involved in legal wrangling as to whether or not that data can be released or not," IDC research director Rahiel Nasir says. He views the US Foreign Intelligence Surveillance Act (FISA) as more problematic because it doesn't go through the normal criminal courts. "That's an executive order," he adds. "They'll just take whatever they need." The increasing number of sovereign public cloud regions promising data residency and local operations can't help with that. Controlling encryption keys Under its EU Data Boundary, Microsoft stores and processes EU customer data and even support logs, at least for core cloud services, inside the EU. AWS has similar commitments for its European Sovereign Cloud, claiming no critical dependencies on infrastructure outside the EU. And like Salesforce, it employs EU-based support staff for its EU operating zone. Google and Oracle have similar dedicated sovereign regions in Europe, and some of the providers plan to offer similar models in other jurisdictions. For admin and support, for example, most tasks are performed through automated, audited workflows, and Microsoft personnel don't have stand