3262: What Sovereign Cloud for Europe Means for Business Leaders

Apr 30, 2025

David Michels, a legal researcher from Queen Mary University of London specializing in cloud services, delves into the intricacies of digital sovereignty in the wake of rising demand for sovereign cloud solutions in Europe. He clarifies misconceptions between data residency and sovereignty, revealing vulnerabilities that persist even when data is stored within Europe. Michels discusses regulatory challenges and proposes a new code of conduct aimed at improving compliance with GDPR. His insights provide a roadmap for navigating the complexities of data control amidst geopolitical tensions.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

Three Meanings of Sovereign Cloud

Sovereign cloud has three main meanings: customer control, foreign government influence, and EU strategic autonomy.
This ambiguity causes confusion and risks, making unified discussion and clarity essential.

INSIGHT

Drivers Behind Sovereign Cloud Demand

Demand for sovereign cloud stems from both regulatory pressure and geopolitical worries.
Organizations balance GDPR compliance with concerns over foreign government access depending on data sensitivity.

ADVICE

Sovereign Cloud Code of Conduct

Develop a GDPR-aligned code of conduct to clarify sovereign cloud compliance.
Cloud providers can voluntarily adopt transparency measures to build trust without waiting for new laws.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

What does digital sovereignty mean in the age of cloud computing, and is Europe finally prepared to rethink its reliance on foreign infrastructure?

In this episode, I speak with David Michels from Queen Mary University of London about his latest research, which examines the growing demand for sovereign cloud services across Europe. Commissioned by Broadcom but developed independently, the report surfaces at a time when regulators, enterprises, and policymakers are all asking tougher questions about who controls data and how.

David explains why the concept of a sovereign cloud is still poorly defined. Depending on who you ask, it might mean autonomy over data, protection from foreign surveillance, or strategic independence from global superpowers. That ambiguity creates confusion for customers and raises compliance risks in regulated industries.

My guest also addresses one of the most persistent misconceptions in the market: the difference between data residency and data sovereignty. Just because data is stored in Europe does not mean it is immune from foreign access if the provider falls under another country's jurisdiction.

We dig into the practical implications of these issues, including why many organizations are reassessing their risk exposure, particularly in light of extraterritorial legal frameworks like the US CLOUD Act.

David outlines a pragmatic approach to improve clarity without waiting for new legislation. His proposed GDPR-aligned code of conduct would allow cloud providers to transparently demonstrate compliance with European data protection expectations, giving customers a stronger basis for trust and accountability.

This conversation is not about cloud theory. It is about legal risk, operational impact, and policy direction. Whether you're a CIO navigating compliance, a regulator shaping guidance, or a provider building cross-border services, this episode offers a clear-eyed look at the shifting demands of digital sovereignty.

Are European organizations finally ready to take a different path in the cloud?