Data sovereignty: what it is and why it matters

Data sovereignty is the principle that data is subject to the laws of the country where it is stored and processed. In practice it covers three things: where the data is, which law governs it, including the law of the provider's home country, and who can access it. It is broader than data localisation, which only states the physical location of the data.

Data sovereignty concerns the data: where it is, which law governs it and who can access it. Digital sovereignty, which the European Union also calls technological sovereignty, concerns the whole technological dependence of a state, a company or a public body: data, infrastructure, software and skills. Data sovereignty is the part of digital sovereignty that a business can verify in its contracts with providers.

The CLOUD Act is the 2018 US law that requires providers subject to US jurisdiction to hand over data requested by a US authority, even when it is stored outside the United States. It applies to a European company's data when the provider of the service, or its parent company, is subject to US jurisdiction, whatever the country of the data center.

No, an EU region of a US cloud provider keeps the data in the European Union, but does not remove it from the CLOUD Act: the provider remains subject to US jurisdiction and can be ordered to hand the data over. Data sovereignty requires the provider itself, not only its data centers, to be subject solely to EU and national law.

No, Microsoft 365 and Google Workspace do not respect data sovereignty in full: Microsoft and Google are US companies subject to the CLOUD Act, even for data stored in Europe. On 10 June 2025 Microsoft France told the French Senate that it could not guarantee the data would never be passed to US authorities. A backup copy on separate infrastructure keeps the data available under a second contract.

Data for Rackone services is stored in the Edge network data centers you choose: the data center we own in Venice, at Noventa di Piave, and partner sites in Italy and Europe. For services on Acronis, data is stored in the Acronis data center in Rome or in another data center in the European Union, as you choose. Your data is not moved without your authorisation.

No, neither NIS2 nor DORA requires data to be stored in a specific country, but both require control over the supply chain. The NIS2 Directive (Article 21) makes supply chain security a mandatory measure; DORA (Article 30) requires contracts to state where data is processed and stored and to give advance notice of any change. A provider with its data and its head office in the EU makes these checks simpler.

Yes, a company outside Italy can use Rackone services: Rackone sells worldwide, and the same team answers in English or in Italian. The data stays in the Edge network data centers in Italy and Europe that the customer chooses, under EU law, whatever the customer's own location.

A cloud provider's data sovereignty is checked with five questions: which data centers and countries hold the data and its backups; which law applies to the provider and its parent company; which subcontractors process the data; how the provider handles a request from a non-EU authority; how much notice it gives before a change of location. They are the same points DORA requires in the contract.

Yes, moving data from a cloud outside the EU to infrastructure in Italy or Europe, also called cloud repatriation, is planned service by service: inventory of data and dependencies, choice of site, migration, verification and decommissioning of the source copy. Rackone designs and runs the migration onto its Edge network, with a rollback plan for each step.