Data Sovereignty

Whose law applies to the data · Sovereign clouds and data-transfer rules · Flagship: AWS European Sovereign Cloud

Data sovereignty now decides how hyperscalers build in Europe. AWS opened a European Sovereign Cloud in Brandenburg in January 2026, run only by EU residents under German companies, to answer the US CLOUD Act, while China, India and the Gulf set their own data-transfer rules.

A ladder of cloud sovereignty in Europe, from a standard US hyperscaler region, to the EU Data Boundary, to AWS's European Sovereign Cloud run by EU residents under a German company, to French SecNumCloud partner clouds such as S3NS; and China's thresholds for exporting personal data HOW MUCH CONTROL STAYS IN EUROPE STANDARD US CLOUD REGIONData in EU; CLOUD Act applies EU DATA BOUNDARYMicrosoft: stored, processed in EU SOVEREIGN REGIONAWS: EU-resident staff, German firms PARTNER CLOUDS3NS, Bleu, Delos under SecNumCloud Each step adds EU legal and operational control. CHINA: EXPORTING PERSONAL DATA (2024 RULES) Under 100,000 peopleexempt 100,000 to 1 millioncontract or certification Over 1 millionstate security review
AWS sovereign cloud
€7.8B
EU egress fees end
January 2027
China exempt below
100,000 people
DOJ data rule
April 2025
Hub
Operations

What it is

Whose Law Applies to the Data

Data sovereignty is about which country's law governs data, and who can be forced to hand it over. It now shapes where and how data centers are built.

  • US reach: the CLOUD Act lets US authorities compel US providers to produce data stored anywhere, the exposure every European sovereign cloud is built to answer.
  • EU rules: the EU Data Act lets customers switch cloud providers within two months and ends egress fees in January 2027. The EU-US Data Privacy Framework survived a court challenge in September 2025; an appeal is pending.
  • US restrictions: since April 2025 the Justice Department bars bulk sensitive data deals with China, Russia, Iran and other countries of concern.
  • China and India: China eased its export thresholds in 2024; India's data protection rules take full effect around May 2027.

Flagship

AWS European Sovereign Cloud, Brandenburg

  • Launch: generally available January 2026, with its first region in Brandenburg, Germany.
  • Structure: a new parent company and three German subsidiaries, led by EU citizens and run only by EU residents.
  • Investment: more than €7.8 billion, with sovereign local zones planned for Belgium, the Netherlands and Portugal.
  • Competitors: Microsoft's EU Data Boundary and Sovereign Cloud; French partner clouds S3NS, qualified under France's SecNumCloud standard in December 2025, and Bleu, still pending. See Reshoring and Sovereignty.

Rules

Sovereignty Laws and Offerings

Data sovereignty laws and sovereign cloud offerings
Law or offeringWhat it doesStatus
AWS European Sovereign CloudBrandenburg, Germany; EU-resident staff; €7.8BLive January 2026
Microsoft EU Data Boundary and Sovereign CloudEU storage and processing; Data Guardian oversightLive
S3NS PREMI3NS (Thales and Google)France's SecNumCloud qualificationQualified December 2025
Bleu (Orange and Capgemini on Microsoft)SecNumCloudQualification targeted end of 2026
EU Data ActCloud switching within two months; egress fees end January 2027In force September 2025
EU-US Data Privacy FrameworkLegal basis for EU-US personal data transfersUpheld September 2025; appeal pending
US CLOUD ActUS providers must produce data wherever it is storedIn force since 2018
DOJ Data Security ProgramBars bulk sensitive data deals with China, Russia, Iran and othersIn force April 2025
China cross-border data rulesThresholds at 100,000 and 1 million peopleIn force March 2024
India DPDP RulesCore duties from about May 2027Enacted November 2025
Saudi PDPL; draft Global AI Hub LawTransfer safeguards; proposed data embassiesIn force / proposed

Record

Dataset Record

Dataset
Data sovereignty laws and sovereign cloud offerings
Sources
Amazon, Microsoft, S3NS, Leto, Cooley, WilmerHale, Hunton, Storyboard18, Clyde & Co, Introl, US Department of Justice
Last verified
October 2026