Reclaiming Control: Digital Sovereignty in 2025
Sovereignty has counted since the invention of the national state – defined by the borders, the laws and the taxes which apply inside and outside. While many have tried to define it, the main idea remains: nations or courts seek to keep control, generally for the benefit of those who are to members of their borders.
Digital sovereignty is a relatively new concept, also difficult to define but simple to understand. Data and applications do not include borders unless it is specified in terms of policy, as coded in the infrastructure.
The World Wide Web had no such restrictions on its creation. Community groups such as the Electronic Frontier Foundation, service providers and hyperscalers, non-profit organizations and businesses have all adopted a model that suggested that the data would take care of itself.
But the data will not take care of itself, for several reasons. First, the data is massively out of control. We generate more all the time, and for at least two or three decades (depending on the historical surveys that I have managed), most organizations have not fully understood their data assets. This creates ineffectiveness and risk – the least, a generalized vulnerability to cyber attack.
Risk is an impact on probability times – and at the moment, the probabilities have increased. Invasions, prices, political tensions and more have brought a new urgency. Last year, the idea of deactivating the computer systems of another country was not on the radar. Now we see that this happens, including the US government blocking access to services abroad.
Digital sovereignty is not only a European concern, although it is often formulated as such. In South America for example, I am told that sovereignty leads conversations with hyperscalers; In African countries, it is stipulated in supplier agreements. Many jurisdictions watch, evaluate and examine their position on digital sovereignty.
As the adage says: a crisis is a problem without time to solve it. Digital sovereignty was a pending problem, but now it’s urgent. He went from a “right of sovereignty”
What does the landscape of digital sovereignty look like today?
Many has changed since that time last year. Unknowns remain, but a large part of what was not clear this time last year is now starting to solidify. The terminology is clearer – for example, talking about classification and location rather than generic concepts.
We see a passage from theory to practice. Governments and organizations set up policies that simply did not exist before. For example, some countries consider “in the country” as a main objective, while others (the United Kingdom included) adopt an approach based on risks based on places of trust.
We also see a change in risk priorities. From a risk point of view, the classic triad of confidentiality, integrity and availability is at the heart of the conversation of digital sovereignty. Historically, the emphasis has been much more important on confidentiality, motivated by the concerns concerning the US A law on the cloud: can foreign governments see my data?
This year, however, availability is increasingly important, due to geopolitics and very real concerns about the accessibility of data in third countries. Integrity is talking about less from one point of view of sovereignty, but is no less important as a cybercrime target – randises and fraud being two clear and present risks.
Thinking more broadly, digital sovereignty does not only concern data, even intellectual property, but also brain flight. Countries do not want all their brightest young technologists to leave university only to find themselves in California or in another more attractive country. They want to keep talent at home and innovate locally, for the benefit of their own GDP.
How do cloud suppliers react?
Hyperscalers play catch -up, always seek ways to satisfy the letter of the law while ignoring (in the French sense) its mind. It is not enough for Microsoft or AWS to say that they will do everything they can to protect data from a jurisdiction, if they are already legally forced to do the opposite. The legislation, in this case, American legislation, calls for gunshots – and we all know how fragile this is at the moment.
We see progress to hyperscalor where they offer technology to manage locally by a third party rather than themselves. For example, Google’s partnership with Thales, or Microsoft with Orange, both in France (Microsoft has similar in Germany). However, these are occasional solutions, not part of a general standard. Meanwhile, AWS ‘recent announcement concerning the creation of a local entity does not solve the problem of seizure of the United States, which remains a central problem.
Software providers and suppliers of software not to hyperscaler have an increasingly important game: Oracle and HPE offer solutions that can be deployed and managed locally for example; Broadcom / VMware and Red Hat provide technologies that are located locally, private cloud suppliers can host. Digital sovereignty is therefore a catalyst for a redistribution of “cloud expenditure” in a wider pool of players.
What can corporate organizations do on this subject?
First of all, see digital sovereignty as a central element of data and the application strategy. For a nation, sovereignty means having solid borders, control over IP, GDP, etc. It is also the objective of companies – control, self -determination and resilience.
If sovereignty is not considered an element of strategy, it is pushed into the implementation layer, leading to ineffective architectures and duplicated efforts. It is much better to decide in advance which data, applications and processes must be processed as sovereigns and define an architecture to support it.
This prepares the field to make informed provisioning decisions. Your organization may have made big bets on the main suppliers or hyperscalers, but multi-platform thinking more and more dominates: several public and private cloud suppliers, with integrated operations and management. The sovereign cloud becomes an element of a well -structured multiplatform architecture.
It is not neutral of sovereignty, but the global commercial value should be tangible. An initiative of sovereignty should provide clear advantages, not only for itself, but thanks to the advantages that come with better control, visibility and better efficiency.
Knowing where your data is, including the important data, by managing it effectively so that you do not reproduce it or do not fragment it between the systems – these are precious results. In addition, ignoring these questions can lead to non-compliance or be downright illegal. Even if we do not use terms such as “sovereignty”, organizations need a handful on their field of information.
Organizations should not think that everything based on the cloud must be sovereign, but should create strategies and policies based on data classification, hierarchy and risk. Build this image and you can first solve the highest priority elements – data with the strongest and largest risk classification. This process alone supports 80 to 90% of the problem space, avoiding making sovereignty another problem while solving anything.
Where to start? First take care of your own organization
The sovereignty and thought of systems go hand in hand: it’s all about scope. In business architecture or business design, the biggest error is to boil the ocean – trying to resolve everything.
Instead, focus on your own sovereignty. Worried about your own organization, your own jurisdiction. Know where your own borders are. Understand who are your customers and what are their requirements. For example, if you are a manufacturer selling in specific countries – what do these countries need? Resolve this, not for everything else. Do not try to plan each future scenario possible.
Focus on what you have, what you are responsible for and what you need to tackle now. Classify and prioritize your data assets according to real risks. Do this, and you are already halfway half the resolution of digital sovereignty – with all the advantages of efficiency, control and compliance that accompany it.
Digital sovereignty is not only regulatory, but strategic. Organizations that act now can reduce risks, improve operational clarity and prepare for a future according to confidence, compliance and resilience.
