‘Where is our data stored?’
‘Where is our data stored?’ is a question that many European organisations are asking themselves more and more.
With all the current geopolitical events, data sovereignty has become one of the most important topics of 2025. Achieving European data sovereignty essentially means that all data generated in the European Union must be processed in accordance with EU laws and regulations, and that access to, storage and use of data must be ensured within the EU area in order to protect your data from external intrusion.
To illustrate this point, here is an infographic from 2024 showing the main data centres around the world.
There are approximately 11,800 data centres worldwide:
- 5,381 are in the United States, or just under 50%
- 2,773 data centres are in Europe, including Russia
- 1,508 are in Oceania and Asia
- 2,138 are in the rest of the world (including Mexico, Canada and Brazil)
Why is this issue so crucial today?
There are two main reasons why data sovereignty has become a central issue of our time. Let’s take a closer look at them.
Firstly, the regulatory and legal framework
The General Data Protection Regulation (GDPR), reinforced by other national regulations, requires organisations to manage personal data rigorously. They must ensure compliance with strict guidelines. In addition, laws have been or are being adopted in several countries that allow access to data stored on their territory for national security reasons. This raises a major risk: losing control over one’s own data.
Data sovereignty ensures that sensitive data remains subject to the laws of the region where it is stored and processed, thereby strengthening its protection.
Secondly, the unstable geopolitical context
Current tensions are encouraging an increase in cyberattacks and increasing data security risks. This could lead to greater restrictions on data access or the availability of digital services. However, these elements are essential to the smooth running of businesses that rely on cross-border data flows.
Data sovereignty is a lever for trust.
Controlling what is done with data, guaranteeing its security and ensuring its transparency are essential conditions for establishing a lasting relationship of trust with customers and partners. By regaining control over your data, you not only offer a guarantee of security, but also a strategic competitive advantage.
How are file transfers directly affected?
We encounter this need for data sovereignty in our daily work. Files are full of sensitive data, and transferring them across borders or via cloud services poses risks to data sovereignty.
Regulations relating to sovereignty, such as the GDPR, have an impact on these transfers by requiring robust data protection measures for file transfers that cross European borders, with transfers to countries that do not have adequate data protection laws even being completely restricted.
When transferring or storing sensitive data, there are four key considerations to analyse:
- Data residency lets you know where your data physically resides during and after transfer, which is important for GDPR.
- Supplier jurisdiction lets you check whether your suppliers are subject to foreign laws such as the US CLOUD Act, which may conflict with EU privacy rules.
- Encryption must be robust both in transit and at rest, and ideally you should control the keys.
- Finally, analysis enables you to prove compliance during audits.
Without clear answers to these assessments, your data security and regulatory position could be seriously compromised.
Integrate compliance into your file transfer workflows
Integrating compliance into your file transfer strategy means incorporating confidentiality, security, and accountability at every stage.
Start by mapping and classifying data to understand the types of data you transfer and their sensitivity. You must then back this up with robust contracts and standard contractual clauses to define how data is protected when shared with third parties.
You should conduct regular audits and risk assessments to identify vulnerabilities and ensure ongoing compliance. You need to be able to show who accessed the data, when and why.
On a human level, implement employee training and strict access controls to prevent misuse or accidental exposure.
To align with European data sovereignty, your strategy must prioritise infrastructure transparency: know exactly where your data is stored and how it flows. Use strong encryption in transit and at rest, and most importantly, retain ownership of encryption keys.
Finally, favour EU-based suppliers and partners who are governed by EU privacy laws and principles.
By combining legal, technical and organisational controls, you create a secure and compliant file transfer process that meets both regulations and customer expectations.
Future prospects
The EU is advancing digital autonomy through initiatives such as GAIA-X, which aims to establish a secure, transparent and interoperable data infrastructure rooted in European values.
At the beginning of 2021, the Gaia-X AISBL association was created by 11 French organisations and 11 German organisations.
Since then, the association has seen exponential growth in its membership, enabling it, especially, to cover its operating costs through membership fees, thus making it financially independent.
The Gaia-X association also joined a project founded by the European Commission due to its nature and strategic importance. This project, the Data Space Support Centre (DSSC), was launched in September 2022 for a period of 42 months.
This reflects a broader trend. Data sovereignty is no longer just a regulatory box to tick, but has become a strategic imperative.
At the same time, more and more companies are moving away from public cloud solutions and adopting hybrid or private architectures. This allows them to better control where data resides, how it moves, and who has access to it, while still benefiting from the scalability of the cloud.
The motivation for these developments goes beyond compliance. Trust and reputation depend on how organisations handle sensitive data. Customers, partners, and regulators increasingly expect clear assurances and accountability.
In addition, operational resilience is at stake. Companies that rely too heavily on global cloud service providers (especially those subject to non-European laws) expose themselves to risks such as unauthorised access, data location conflicts, or service interruptions related to geopolitical issues.
Embracing data sovereignty enables your organisation to prepare for the future by aligning with evolving regulations, strengthening stakeholder trust, and building more resilient and transparent digital ecosystems.
Sources:
https://dcmag.fr/ou-sont-les-data-centers-dans-le-monde/
https://fr.wikipedia.org/wiki/Gaia-X
