As geopolitical disruption intensifies, as I highlighted in my blog “Why US Isolationism is Now a Global Cloud Risk”, concerns around the use of non-sovereign cloud services are growing. Regulations such as the EU GDPR, together with the Schrems II ruling, and similar regulations in other jurisdictions require not only data protection, but also jurisdictional control. This creates a dilemma: how can organizations continue to benefit from global cloud services while maintaining sovereign control over personal or sensitive data?
.png)
Figure 1: Cloud Sovereignty Risks
The responsibility for sovereignty is shared between the Cloud Service Provider (CSP) and the cloud customer. The CSP is responsible for implementing appropriate sovereignty controls such as the jurisdiction of data centers, legal entity providing the service, and operational access controls. Cloud customers are responsible for implementing appropriate technical controls to mitigate any residual sovereignty risks.
Confidential computing and related privacy-preserving technologies enable technical enforcement of data sovereignty, even when data is processed in clouds located in or controlled by foreign jurisdictions. In this blog I will explain these.
Customer Controls to Mitigate Sovereignty Risks
There are four main areas where technical controls can reduce the sovereignty risk.
- Protecting data at rest in the cloud from extra-jurisdictional access.
- Protecting data in transit from extra-jurisdictional access.
- Protecting data while it is being processed from extra-jurisdictional access.
- Ensuring data held in cloud services can be retrieved.
The cloud customer’s identity and access controls while being essential do not protect their data from extra-jurisdictional access if they can be bypassed by the cloud service provider’s service administrators. The major cloud services all offer encryption managed by the cloud provider; while this is helpful to protect against certain cyber threats the customer does not control access to the keys. The cloud customer needs to protect their data against extra-jurisdictional access throughout its lifecycle Leadership Compass: Data Security Platforms.
Data resilience is also an important area that I will cover in a future blog.
Encryption In-Transit and At-Rest with Customer-Held Keys
End-to-end encryption protects data from unauthorized access during transit and storage. Crucially, sovereignty is preserved providing the encryption keys remain under the exclusive control of the cloud customer. See Leadership Compass: Enterprise Secrets Management.
Benefits:
- It protects the data against unauthorized and extra-jurisdictional access.
- Enables compliance with Schrems II and other extraterritorial regulations.
- Can leverage Hardware Security Modules (HSMs) that provide additional control.
Residual Risks:
- Data must be decrypted during processing unless used within confidential enclaves.
- Does not protect against traffic pattern analysis.
- It is of limited use to protect data processed in Software as a Service (SaaS) because of the processing limitation.
Pseudonymization Prior to Data Transfer
Pseudonymization, as defined by ENISA and GDPR Recital 29, removes or masks data before it leaves a sovereign boundary. The pseudonym mapping keys must remain within a trusted jurisdiction. For certain use cases, Synthetic data which is artificially generated to mimic the characteristics and statistical properties of real-world data, but without revealing actual private or sensitive details, may also be useful.
Benefits:
- Protects against unauthorized and extra-jurisdictional access.
- Acts as a valid supplementary safeguard under EU data protection law.
- Can be used for analytics, AI training, and SaaS data storage.
Residual Risks:
- Improperly pseudonymized data can be decoded using analytic techniques.
- The mapping keys must be secured to prevent reidentification by an attacker.
- Of limited use in most standard SaaS use cases.
Trusted Execution Environments (TEEs)
Confidential computing environments—also called trusted execution environments (TEEs)—allow secure processing of data while it remains encrypted in memory. These provide hardware enforced supplementary protection of data while it is being processed.
Benefits:
- Protects against unauthorized and extra-jurisdictional access to the plaintext data during processing.
- Typically offered by leading Infrastructure as a Service (IaaS) cloud providers.
- Useful for cloud disaster recovery scenarios requiring failover between regions.
Residual Risks:
- Insufficient without other controls.
- Only supported by a limited range of SaaS / PaaS.
- Depends upon trust in the hardware implementation.
Homomorphic Encryption for Privacy-Preserving Computation
Homomorphic encryption (HE) is a cryptographic technique that allows data to be processed in encrypted form. Unlike traditional encryption, which requires data to be decrypted for use, homomorphic encryption enables computation on ciphertext—yielding encrypted results that, when decrypted, match the outcome of operations on the plaintext. It is described in more detail here blog fully homomorphic encryption at a glance.
Benefits:
- Eliminates the need to expose raw data during computation.
- Supports privacy-preserving analytics, federated learning, and regulatory reporting.
- Enhances data confidentiality in hybrid and multi-cloud architectures.
Residual Risks:
- There is a significant increase in the computing power needed to implement it.
- May only support a limited range of computational functions.
- Not widely supported across existing cloud platforms.
Multi-Party Computing
Multi-party computing (MPC) is a cryptographic technique that allows multiple parties to compute something together without revealing their individual inputs to each other. It allows data controllers in different jurisdictions or organizational boundaries to collaborate without exposing sensitive information. It enables shared analytics, fraud detection, or regulatory reporting without sharing the complete data.
Benefits:
- Enables secure cross-border or cross-organization collaboration while retaining privacy.
- Preserves confidentiality of data during the entire computation process.
- Aligns with zero-trust approaches and federated architectures.
Residual Risks:
- It can be very compute intensive.
- It may require more network interactions making it slower.
- Protecting and managing the secrets needed to reconstruct split data.
Opinion - Architecting Sovereignty
Data sovereignty is defined by a range of laws, legal frameworks, and regulations. Assuring sovereignty depends upon a complex ecosystem of technical controls, best practices, and operational architecture. Confidential computing enables a new class of sovereignty-aware architecture, which can help organizations to enforce jurisdictional boundaries when using non-sovereign clouds.
By combining state-of-the-art encryption, pseudonymization, trusted execution environments, and emerging techniques like homomorphic encryption, organizations can potentially address the risks—without sacrificing the scalability and flexibility of cloud computing. While data sovereignty often has a focus on extra-jurisdictional access it is also important to include secure cloud data backup in your architecture to mitigate the risks of losing access to data. I will cover this in a later blog.
To learn more about this and other cyber security development register for Identity-Centric Cybersecurity Impact Day 2025 in Frankfurt November 6th, 2025.
