Coonti 
Blog

Who Controls Your Data?

Let me ask you a deceptively simple question: Who controls your data?

You probably know where your data is stored. You may even know which cloud provider stores it.

But do you know who controls the company operating that infrastructure? Which jurisdiction that company is subject to? Who can legally demand access to your data? What happens when your data moves through another service? And, perhaps most importantly, could you move away from your current technology provider if you had to?

For many European organisations, the uncomfortable answer is: not entirely.

We have built much of Europe’s digital economy on technology platforms controlled outside Europe. We are now discovering that this is not merely a technology decision. It is a question of control.

Europe has outsourced too much of its digital infrastructure

Amazon, Microsoft and Google account for about 70 percent of the EU cloud market. Around 80 percent of European corporate spending on enterprise software goes to US vendors.

These companies built their lead for good reasons. They had access to enormous markets, capital and talent, and they moved quickly when the internet economy was developing.

Europe, meanwhile, largely accepted the situation. And once organisations had built their systems around these platforms, the lock-in effect made leaving increasingly difficult.

This is where I think Europe has made a strategic mistake. We have treated digital infrastructure as a commodity rather than as infrastructure that determines our economic and technological independence.

We would never consider it sensible for a country to become completely dependent on foreign suppliers for electricity, telecommunications or critical physical infrastructure.

Yet we have allowed a similar dependency to develop in the digital world.

Data sovereignty is about more than GDPR

The discussion around data sovereignty is often reduced to data protection—which is too narrow. Data protection asks whether personal information is handled appropriately and lawfully.

Data sovereignty asks a different question:

Who has the authority to control the data?

My working definition of European data sovereignty is the ability of European organisations to retain effective control over their data, digital infrastructure and data processing activities within the European legal and governance framework.

That means looking at four dimensions.

• Legal sovereignty: Is the data governed by European law, without conflicting foreign legal claims?

• Operational control: Can the organisation decide how its data is processed, accessed and transferred?

• Infrastructure independence: Is the organisation structurally dependent on providers whose governance is outside Europe?

• Technical sovereignty: Does the organisation control critical elements such as encryption keys, identity management and system architecture?

This distinction matters because putting data in a European data centre does not automatically make it sovereign. The company operating that data centre, the software running on it, the support organisation administering it and the parent company owning the provider can all matter.

Geography is no longer enough

The old mental model was simple: My data is in Finland, therefore my data is in Finland.

Modern digital infrastructure doesn't work like that. Data flows through global value chains involving cloud platforms, SaaS providers, AI services, subcontractors, support organisations and software components.

A European organisation can have data physically located in Europe while still being dependent on companies subject to foreign legislation.

Extraterritorial legislation makes this particularly important. The US CLOUD Act is one example. Other countries have developed their own laws with effects beyond their borders.

This creates a difficult situation for European companies. You may have obligations under European regulation, while your technology provider may simultaneously face obligations under another jurisdiction.

And if those obligations conflict, your organisation is still responsible for its own compliance.

This isn't about declaring war on American technology

There is an important point here that is sometimes lost in the political debate. I am not arguing that European organisations should immediately abandon every US technology provider. Nor do I think legislation alone will solve the problem.

In fact, I believe Europe should spend less time trying to regulate its way out of technological dependency and more time building competitive alternatives. If Europe wants digital sovereignty, we need European companies building excellent cloud infrastructure, databases, AI platforms, software and digital services.

The objective should not be to build a digital fortress. It should be to create real choice; A European organisation should be able to choose a US provider because it is the best option—not because there is no realistic alternative.

Treat sovereignty as risk management

There is also a practical reason for taking this seriously. Data sovereignty is fundamentally about risk mitigation.

Two risks stand out:

• First, your organisation may be affected by legislation outside the EU.
• Second, your vendors may not meet the requirements that apply to your organisation.

The probability of a serious incident may be relatively low. The consequences can nevertheless be severe.

If a critical vendor suddenly cannot provide a service, if access to data is restricted, if a regulatory requirement changes, or if geopolitical circumstances disrupt an important part of your technology supply chain, the impact can extend far beyond the IT department.

You don't need to fix everything

One of the worst ways to approach data sovereignty is to decide that everything must become sovereign immediately.

That is unrealistic.

Instead, start by understanding what you have.

• Where is your data actually processed?
• Who owns the companies involved?
• Which jurisdictions apply?
• What does your contract say?
• Who can access the data?
• How dependent are you on a particular provider?

Then classify the data. Public information does not require the same treatment as confidential business data, regulated personal data or data whose compromise could threaten business continuity.

Once you understand both the data and its business criticality, you can prioritise. Some dependencies will be acceptable, some should be reduced, and some may be unacceptable altogether.

The point is to make those decisions deliberately rather than discovering them during a crisis.

Your vendors work for you

There is a very simple principle in business: They who have the gold, make the rules. If you are a customer, use that position. Put sovereignty requirements into procurement criteria.

Evaluate technology vendors based on jurisdictional exposure, governance transparency, interoperability and portability. Demand clarity around data access, cross-border transfers and government disclosure requests.

And, critically, ask one question that organisations too often forget: How do we leave? A technology platform that you cannot realistically migrate away from is a strategic dependency, regardless of how attractive the service is today. Exit strategies are therefore not signs of distrust. They are signs of competent technology governance.

Sovereignty is not a project. It is a capability.

Even if you successfully reduce your dependencies today, the work isn't finished.

Companies are acquired. Regulations change. Technologies change. Cloud providers change their products and business models. New AI services introduce new dependencies.

Sovereignty therefore needs to become part of the normal technology lifecycle. Vendor assessments need to be repeated, architecture needs to be reviewed, contracts need to evolve, and migration options need to remain realistic.

In other words, sovereignty is not something you buy. It is something you maintain.

Europe needs to start building again

Europe is spending enormous amounts of money on technology platforms developed elsewhere. That money doesn't just pay for software and infrastructure. It also finances the companies, knowledge, ecosystems and competitiveness of the regions where those platforms are developed.

We are effectively funding the development of technologies that can make our own digital dependency even stronger. At some point, we need to ask whether that is a sustainable economic strategy.

I don't think it is.

Europe needs to invest in its own digital capabilities—not simply because European technology is inherently better, but because having alternatives creates strategic freedom.

And the rest of the world can benefit from those alternatives too.

The first step is not replacing your cloud provider

If this sounds like an enormous undertaking, it doesn't have to be. The most important decision is whether to start acting. Start by mapping your dependencies, then classify your data, identify your critical technology providers, and understand their ownership and jurisdictional exposure.

Finally, review your contracts. Assess how easily you could migrate if circumstances changed.

Then pick one area where you can make a meaningful improvement. You don't need everything to be sovereign tomorrow. You need to become less dependent than you are today.

That is the journey. And like every journey, it starts with a first step.