01Three terms that are not interchangeable
Most of the confusion, and most of the compliance risk, comes from blurring three distinct ideas. Pin them down first, because each needs a different solution.
Data residency
The geographic location where data is physically stored or processed. “Our data is in a Frankfurt region” is a residency statement: it is about where, nothing more.
Data sovereignty
Whose laws and jurisdiction the data is subject to and, crucially, who can lawfully compel access to it. Data can reside in one country yet remain reachable under another country's laws.
Data localisation
A legal requirement that specific data stays within a country's borders. Not a choice but a mandate, common for government, health, financial and personal data in many jurisdictions.
The trap is assuming residency delivers sovereignty. Store data in-country with a foreign-owned provider and it may still be reachable by that provider's home government: residency satisfied, sovereignty not.
02The laws making this urgent
Data sovereignty is the collision of privacy law, foreign-access law and a wave of localisation rules, sharpened by geopolitics and the race for sovereign AI.
The headline instruments to know:
GDPR and UK GDPR
Europe's baseline. Strict rules on processing personal data and on transferring it outside the UK or EEA: you must guarantee an equivalent level of protection wherever it goes.
Schrems II (2020)
The CJEU struck down the EU-US Privacy Shield and put Standard Contractual Clauses under heavy scrutiny, because US surveillance law could reach EU data. Transfer mechanisms became a live compliance risk.
US CLOUD Act
Lets US authorities compel US-headquartered providers to hand over data regardless of where in the world it is stored. This is why in-country residency with a US provider may not equal sovereignty.
Data localisation laws
A growing number of countries, and sectors, require certain data (government, health, financial, telecoms) to be stored and processed within national borders.
Sector and national rules
The UK DPA 2018, NIS2 and critical-infrastructure rules, financial-services and government classification schemes: layered obligations that often go beyond GDPR for regulated data.
Sovereign AI and geopolitics
Governments increasingly want AI, and its training data, built and held under their own jurisdiction. That makes sovereign infrastructure a strategic concern, not only a compliance one.
Obligations depend on your data, sector and jurisdiction, and the law is evolving (the EU-US Data Privacy Framework, new localisation rules and more). The point is not to memorise statutes. It is to recognise that where and how you host data has legal consequences, and to design for them.
03The spectrum of control
Sovereignty is not binary. It is a spectrum, traded against agility and cost.
As you move from public cloud towards owned infrastructure, residency tightens, foreign-law exposure falls and control rises. Explore the trade-offs:
Interactive / The sovereignty spectrum
From public cloud to owned infrastructure
Pick a hosting model to see its residency, foreign-law exposure, control and sovereignty.
Colocation (in-jurisdiction)
Your own hardware in a facility in the country you choose, operated under local law. You control the equipment, the keys and the access; the facility provides power, cooling and connectivity.
There is no universally right answer, only the right answer for a given dataset and its obligations. Most organisations end up with a mix: public cloud for low-sensitivity workloads, and colocation or owned infrastructure in-jurisdiction for the regulated, sovereign or AI data that cannot leave.
04Sovereignty is ultimately physical
Strip away the contracts and the marketing and sovereignty comes down to four physical facts: where the building is, whose law it sits under, who owns and operates it, and who can get to the hardware.
You cannot fully outsource or out-contract those; infrastructure decides them. The strongest sovereignty position is the one with the most physical control.
- 01
Where it is
The jurisdiction the facility sits in sets the baseline law: the non-negotiable starting point for residency and localisation.
- 02
Whose law applies
Not just the building's country but the ownership chain. A foreign parent can bring data within its home jurisdiction's reach, wherever the equipment sits.
- 03
Who operates it
A local entity, local staff and local control of access and keys: the operational separation that turns “in-country” into genuinely sovereign.
- 04
Who can touch it
Physical access control, an audited chain of custody and, at end of life, certified data destruction so nothing leaves uncontrolled.
This is why so many regulated and security-conscious organisations are moving sovereign workloads onto colocation or owned infrastructure in the jurisdiction that matters. It is the cleanest way to make the legal answer and the physical answer the same.
05How Optronix helps
Sovereignty is an infrastructure decision, and infrastructure is our work.
We help you turn the legal requirement into the right physical home for your data, and get it there, across the UK, Europe and the wider EMEA region.
- 01
Understand the requirement
We translate the regulatory and sovereignty obligations on each dataset into clear infrastructure requirements (residency, jurisdiction, ownership, access and isolation), so you solve the right problem without over- or under-building.
- 02
Select the right data centre
Vendor-neutral, we help you find and evaluate the right facility in the right jurisdiction, colocation or owned, against sovereignty as well as tiers, power, connectivity and commercials. See our buyer's guide, or explore facilities by jurisdiction on the Data Centre Map.
- 03
Migrate safely
We plan and execute the migration of your estate into the compliant, sovereign location (move-group planning, sequencing and cutover) with minimal disruption and an auditable chain of custody throughout.
- 04
Build and operate in-jurisdiction
If you need your own, we design, build and operate data halls in the country you need, delivered locally, with the physical and operational control that genuine sovereignty requires.
Sovereign hosting
Tell us the data, the regulations and the regions in play.
We will help you define the requirement, choose the right sovereign home for it and migrate there cleanly.
Sources and notes
- GDPR (Regulation (EU) 2016/679) and UK GDPR / Data Protection Act 2018; international transfer rules and Standard Contractual Clauses.
- Schrems II: CJEU Case C-311/18 (2020), invalidating the EU-US Privacy Shield.
- US CLOUD Act (2018) on extraterritorial access to data held by US-based providers. Data localisation requirements vary widely by country and sector.
Educational guidance, not legal advice. Data protection and sovereignty obligations depend on your data, sector and jurisdiction and are evolving (including the EU-US Data Privacy Framework and new national rules). Confirm current requirements with qualified legal counsel before making compliance decisions.