How do you maintain data sovereignty in the cloud?

The geopolitical developments of recent years have compelled organisations to look closely at the sovereignty of their data. We asked Nicola Carone, Digital Infrastructure Squad Lead for BeLux at Orange Business, to explain. His role is to help clients navigate a complex cloud landscape daily.

What does Orange Business mean by data sovereignty?

“There is no official definition, so every organisation can determine what exactly it means for them. For us, data sovereignty means that an organisation retains full independence from external entities over its data. This is also not a simple definition: what exactly ‘control’ entails depends on the organisation itself. A significant part of our role as an IT partner is to support our clients in defining together what data sovereignty means for them.”

Why is this issue gaining so much attention right now?

“Regulations and geopolitical shifts are two major reasons. We are living in a completely different geopolitical context from 10 years ago, when everyone started migrating to the public cloud. Take the US Cloud Act, which allows US security agencies to request data from American companies, even if they’re located in Europe. Many companies no longer want to depend on American companies for all their data and infrastructure, and they’re seeking the right mix between private and public cloud solutions. The landscape is shifting toward a hybrid multi-cloud approach.”

The role of a partner like Orange Business becomes crucial in defining the best architecture that complies with internal policies and regulations. Nicola Carone, Digital Infrastructure Squad Lead for BeLux at Orange Business

What are the challenges for organisations that want to achieve data sovereignty in the cloud?

“Many of our clients still have questions about defining data sovereignty. A thorough assessment of the existing infrastructure’s dependency on non-European solutions and providers is a first step. If they want to reduce certain dependencies, we look for alternatives, designing the right solution after assessing their circumstances. We have to be honest: currently, Europe doesn’t have hyperscalers like the United States does, so the role of a partner like Orange Business becomes crucial in defining the best architecture that complies with internal policies and regulations.”

Are certain sectors more affected than others?

“Ultimately, data sovereignty will be an issue in every sector, but for now, questions mainly come to us from the financial and healthcare sectors and the public sector. For example, Belgian hospitals are looking for solutions for storing patient data in European data centres. The banking, insurance and defence sectors are looking closely at the issue as well.”

How do you support organisations after your initial assessment?

“We can support all definitions of data sovereignty, from full EU to full non-EU service structure, depending on customers’ needs. When data needs to be stored in the EU and services provided from EU territory, EU sovereign solutions like Orange Cloud Avenue are the best answer. They’re fully operated and hosted in the EU with the flexibility of a hyperscaler.”

What do you advise organisations that are starting to work on data sovereignty?

“The most important first step is understanding what the existing infrastructure looks like. Then comes analysis of the dependencies to understand where changes are required because of regulation or strategy. Ideally, this process should happen with the support of advisors like Orange Business, to make sure that organisations’ infrastructures aren’t left without a plan B, relying only on non-EU technologies.”