EU data sovereignty and datacenter selection

Discussions blur three distinct things. Data residency: where data is physically stored and processed. Jurisdiction: which governments can compel access to it — a function of facility location and of the operator’s corporate ownership. Operational autonomy: who can actually touch systems — where administrators, support staff and escalation paths sit.

A facility can score well on one and poorly on another: EU soil under a US-parented operator gives residency without full jurisdictional separation; an EU-owned operator whose support runs from outside the EU gives jurisdiction without operational autonomy. Precision about which of the three your requirements actually demand keeps shortlists honest — and larger than they need to be otherwise.

The GDPR governs personal-data processing across the EU and restricts transfers to third countries; the EU-US Data Privacy Framework currently underpins many transatlantic flows, with its long-term durability a recurring legal question. Sector rules add layers: DORA for financial entities, NIS2 for essential and important sectors, and national health-data regimes such as France’s HDS.

The tension buyers care about most: the US CLOUD Act can oblige US-parented providers to produce data in their possession or control regardless of where it is stored. EU facility, US parent — the obligation can still attach. How that plays against GDPR obligations is contested legal ground, which is exactly why ownership questions have moved to the front of procurement.

The UK sits outside this framework post-Brexit: UK GDPR remains closely aligned and the EU currently recognises the UK as adequate, but organisations with strict EU-jurisdiction requirements treat London deployments as a separate assessment.

Ownership first: the ultimate parent entity and its jurisdiction, not the local subsidiary’s registration. European datacenter consolidation means ownership changes hands — a sovereignty posture built on a specific owner needs contractual protection against change of control.

Then operations: where remote hands, NOC and escalation sit; who holds administrative access to building-management and security systems; where monitoring data and access logs are processed. For colocation these matter less than for cloud — your equipment stays yours — but facility-level access and camera footage still fall under someone’s jurisdiction.

ISO 27001 with the facility in scope is the baseline; EN 50600 adds European datacenter-specific design assurance. National schemes go further where they apply: France’s SecNumCloud and HDS, Germany’s BSI C5 attestation. The EU cloud certification scheme (EUCS) has been years in negotiation — precisely because its sovereignty tier would formalise the ownership question — and is worth tracking rather than assuming.

Marketing initiatives and membership logos signal intent, not guarantees. The test remains the same: which entity, under which law, with which contractual commitments, operates the facility you are buying into.

Common postures, in increasing strictness: EU residency only (any operator, EU soil — often enough for data-location policies); EU jurisdiction (EU-owned operator on EU soil — the CLOUD Act consideration); and EU operational autonomy (EU ownership plus EU-based operations and support — the strictest tier, with the shortest supplier list, mostly regional and national operators).

Colocation has a structural advantage here over cloud: because the hardware is yours, encryption keys, admin access and data never need to leave your control — the facility question reduces to physical access and jurisdiction over the building. That makes a sovereignty posture often easier to defend in colocation than in managed services, and it widens the field of workable operators.

European metros differ in supplier mix: the large international hubs are dominated by global (often US-parented) operators, while national markets — the Netherlands, Germany, France, the Nordics — retain strong EU-owned regional players. Filtering on both capability and ownership is exactly where a neutral comparison layer earns its keep.