Table of Contents
One figure sums up the German data sovereignty debate rather well. In the Bitkom Cloud Report 2026, 59 percent of the companies surveyed name lock-in effects as the biggest obstacle to changing provider, citing difficult data exports or costly migrations. Yet when it comes to selection criteria for a cloud provider, only 37 percent count easy switching among their must-haves (Bitkom). The best-known problem is mostly not checked at the point of the decision that causes it. This article explains what data sovereignty means legally and technically, and translates it into criteria you can actually put in a tender.
What is data sovereignty?
Data sovereignty is an organisation’s ability to determine independently what happens to its data: collection, storage, processing, disclosure and deletion. The second part of that definition is the one vendor brochures like to drop. Sovereignty covers not only the right but the actual technical and organisational ability to enforce that right.
Data sovereignty, legal control and data residency: three questions, three answers
The terms get muddled across the market, and the confusion is expensive. Three levels can be separated cleanly:
| Term | Answers the question | Character |
|---|---|---|
| Data residency | Where does the data physically sit? | A contractually assurable operating property. Says nothing about access rights. |
| Data localisation | Where must the data sit by law? | A statutory obligation for certain data types, not relevant to every company. |
| Legal control over data | Who holds jurisdiction and decision-making authority? | The legal layer. In everyday usage mostly treated as a synonym for data sovereignty. |
| Data sovereignty | Who decides on access, can I enforce it, and can I switch provider if needed? | Legal, technical and organisational layers combined. |
| Digital sovereignty | How self-determined are we in the digital sphere overall? | Umbrella term. Additionally covers infrastructure, platforms, standards and skills. |
The most expensive misconception in the market is equating residency with sovereignty. A data centre in Frankfurt is proof of location, not protection against access.
Why an EU data centre is not enough
There is an unusually clear piece of evidence for this. On 10 June 2025 a representative of Microsoft France testified under oath before a French Senate inquiry. Asked whether he could guarantee that data belonging to French citizens would never be transferred to the US government without the explicit consent of French authorities, he answered that he could not give that guarantee. He added that it had not happened so far (hearing at the French Senate).
The reason is not vendor negligence but the legal position. A company subject to US jurisdiction can be subject to US disclosure obligations regardless of where its servers stand. It does not follow that every request would be lawful or that data is in fact handed over: providers can challenge requests, procedural routes and transparency reporting exist, and the technical arrangement, such as who holds the keys, changes the practical reach considerably. What remains is a residual risk that location alone does not remove. The second question is therefore which legal system the operator is subject to, and what control over keys, access and operations actually sits outside that jurisdiction.
The legal framework in 2026
Four instruments matter for the decision. They sit at very different stages of maturity, and that distinction is regularly blurred in market communication.
EU Data Act: the procurement lever
The Data Act, Regulation (EU) 2023/2854, entered into force on 11 January 2024 and has applied since 12 September 2025. For cloud customers, Chapter VI is the decisive part: it obliges providers to remove switching obstacles, provide open interfaces and, for PaaS and SaaS, enable export in a commonly used machine-readable format. For IaaS the principle of functional equivalence applies in addition (European Commission).
Two points are almost universally misreported here. First, switching charges have not yet been abolished. They disappear entirely, including charges for data egress on switching, only from 12 January 2027. During the transition period from January 2024 until then, providers may still charge the direct costs actually incurred. Second, the removal expressly concerns switching, not ongoing operation: normal egress costs for delivering data out of the cloud to your own users remain in place. And services going beyond the statutory minimum, such as conversion into a specific target format, remain chargeable even after 2027.
In practice this is not a compliance topic but a negotiating lever. Anyone signing a contract today that runs beyond January 2027 should fix export formats, transition periods and the boundary between minimum service and chargeable extra in writing now.
BSI C3A: the most practically relevant benchmark in German-speaking markets
On 27 April 2026 the German Federal Office for Information Security published the C3A criteria catalogue for the first time, Criteria enabling Cloud Computing Autonomy (BSI, German only). The distinction from the well-known C5 matters: C5 assesses security properties, C3A assesses whether a cloud offering can be used self-determinedly in a given risk context. C3A presupposes compliance with C5.
C3A has no regulatory force; it is a procurement framework. For a company currently writing a tender it is therefore more valuable in practice than any political declaration of intent, because it supplies verifiable criteria rather than commitments.
Cloud and AI Development Act: announced, not in force
On 3 June 2026 the European Commission adopted the proposal for the Cloud and AI Development Act (European Commission). It defines cloud and AI sovereignty through four assurance levels, ranging from processing within the Union alone, through evidence of independence from third countries and EU ownership, to full control over the software supply chain.
The classification matters: this is a Commission proposal, not applicable law. Negotiations between Council and Parliament are still to come, and the sovereignty framework is regarded as the central point of contention. Anyone formulating requirements today should anchor them in C5 and C3A and carry the CADA levels at most as a target picture.
EUCS: blocked for years
The European cloud certification scheme EUCS has not been adopted. The ENISA publications page still carries the draft version from December 2020 (ENISA). The process is blocked over sovereignty and localisation requirements; a 2024 draft dropped the hard provisions and replaced them with a disclosure obligation. Treat market claims announcing first EUCS certificates with scepticism.
Adequacy decision and the CLOUD Act
The adequacy decision on the EU-US Data Privacy Framework remains in force. The challenge against it was dismissed by the General Court of the European Union on 3 September 2025 (IAPP). An appeal has been pending before the Court of Justice since late October 2025; no hearing date was known at the time of writing. For planning purposes that means the framework applies but remains subject to challenge. Anyone signing multi-year contracts today should contractually anticipate another annulment rather than hope it will not happen.
Gaia-X: what actually became of it
Gaia-X is presented alternately as Europe’s answer to the hyperscalers and as a failed project. Neither is accurate.
Gaia-X is not a cloud provider and never was one. The association supplies a trust framework, a compliance document, labels and a network of clearing houses. The German funding projects were declared concluded by the Federal Ministry for Economic Affairs on 1 April 2025 (BMWE, German only). Criticism came early and was justified: US and Chinese corporations joined the alliance as early as 2021, which for many observers undercut the sovereignty claim.
The sober assessment for a selection decision in 2026: Gaia-X has an indirect effect through data space ecosystems such as Catena-X. It does not provide a practically usable seal of approval for your PIM tender. Anyone needing verifiable criteria today reaches for C5 and C3A.
Operating models compared
Sovereignty is not a yes-or-no property but a question of depth of control. The overview below orders the common models along exactly that dimension. The order is an orientation rather than a fixed ranking: who holds the encryption keys, which sub-processors are involved, where the platform control plane sits and which staff have access can shift the assessment in an individual case. A well-secured EU region with customer-managed keys can offer more control than a poorly run data centre of your own.
| Model | Depth of control | Typical limitation | When it makes sense |
|---|---|---|---|
| Public cloud, global region | Low. Location often selectable, operator jurisdiction unchanged | Third-country access not legally excluded | Non-critical data, high need for speed of innovation |
| Public cloud, EU region | Medium. Residency assured | Residency is not sovereignty, see the Senate hearing | Standard case for data with moderate protection needs |
| Dedicated operation by an EU partner | High. Operations, keys and identities with the European partner | Availability partly still announced only, feature scope can lag | Data with high protection needs alongside a wish for hyperscaler functionality |
| Private cloud with a European provider | High. Operator outside third-country jurisdiction | Smaller feature portfolio, more work in-house | Engineering, pricing and compliance data |
| On-premises | Very high | Highest staffing and investment needs, innovation speed drops | Where regulation demands it or the protection level makes it unavoidable |
The reality check belongs with it: according to the Bitkom Cloud Report 2026, 85 percent of companies surveyed consider Germany too dependent on US cloud providers and 91 percent would prefer German providers, yet 43 percent say no equivalent European alternatives currently exist for their requirements (Bitkom Cloud Report 2026, German only). A risk-based approach is therefore more realistic than a blanket commitment: not every data object needs the highest depth of control.
Data sovereignty at the application layer
The entire public debate revolves around infrastructure: data centres, hyperscalers, key management. For an industrial company, though, the actual value sits one layer up. A PIM or MDM holds product attributes, pricing structures, supplier relationships, technical specifications and compliance records. That is the crown jewel, not the virtual machine.
For software selection it follows that three questions matter more than the data centre location.
What belongs in a complete data export?
The Data Act obliges providers to export in a commonly used machine-readable format. What that covers in concrete terms is not defined. Which is exactly why the definition belongs in your tender:
- Master data for all object types, not only products
- History and version states, not only the current state
- Relationships and references between objects, otherwise you export a list rather than a data model
- Classification trees and attribute definitions including value lists
- Media assets with metadata and assignments
- Workflow configuration and the roles and permissions model
- All of it in documented, open formats, at no extra cost, with a reproducible test export carried out once before signature
The last point is the most important and the most uncomfortable. An export promise in a contract is worth little if nobody has ever tried it.
Replaceability of the AI model provider
This point is new and barely features in sovereignty debates so far. As soon as a PIM copilot sends product data to an external language model, data sovereignty comes down to four questions. Where do the prompt and the context go? Is customer data used to train models? How long are prompts and outputs retained? And can the model provider be swapped without reimplementing the function? Which AI functions in PIM are sensibly automatable today, and which controls belong with them, is covered in our article on AI in PIM.
Freedom of choice in the operating model
The third question is the simplest and still rarely asked: can the same software run in different operating models, without loss of function and without reimplementation? Anyone starting in the public cloud today who has to move for regulatory reasons in three years wants that answered in advance. The Viamedici EPIM platform, for instance, can be operated cloud-based, hybrid or on-premises. That keeps the decision open in principle rather than settling it definitively at implementation time. What a later move actually involves, meaning the migration effort and whether individual functions depend on the model, belongs confirmed in writing by the vendor before signature in every case. Do not rely on a product brochure for it.
Data classification: not every attribute needs the same protection level
The most workable entry point is not a decision of principle but a sorting exercise. Product data is not homogeneous:
| Data type | Example | Protection need | Consequence |
|---|---|---|---|
| Public catalogue data | Dimensions, colours, article names | Low. Published anyway | Public cloud uncritical |
| Channel-specific marketing content | Descriptions, image selection per market | Low to medium | Public cloud defensible |
| Costing-relevant data | Purchase prices, terms, margins | High | Access protection and role model decisive |
| Engineering and technical data | Bills of materials, tolerances, production parameters | High to very high | Consider an operating model with high depth of control |
| Compliance and evidence data | Certificates, test reports, declarations of conformity | High | Traceability and retention matter more than location |
This sorting is itself a governance task. Approaching it systematically requires clear accountability per data object; how to organise that is described in our article on data governance, and the associated role in the article on the data steward.
Ten questions for the PIM tender
Concrete, verifiable, free of commitment rhetoric:
- In which operating models is the software available, and which functions are missing in each model?
- Which legal system is the operator subject to, and who holds the encryption keys?
- Which sub-processors are involved, and in which countries are they based?
- Which data types leave the EU in normal operation, and for what purpose?
- What exactly does a data export cover, and will you run a test export before signature?
- In which formats is the export delivered, and are they documented and open?
- What does switching cost today, and how does that change from 12 January 2027?
- Which language model is used for AI functions, and can it be replaced?
- Is our data used to train models, and how long are prompts retained?
- Which certifications are in place, C5 in particular, and how does the provider position itself on C3A?
Conclusion
Data sovereignty is not a political stance but a chain of verifiable properties: where the data sits, which legal system the operator is subject to, who holds the keys, what you get back on exit, and whether you can still change the operating model later. The Data Act gives you an additional lever from January 2027, C3A has supplied verifiable criteria since April 2026, and the rest is contract work. The most workable starting point is unglamorous: sort your data by protection need before you talk about providers. And ask to see a test export while you still have negotiating leverage.
Frequently asked questions about data sovereignty
Data sovereignty is an organisation's ability to determine independently what happens to its data: collection, storage, processing, disclosure and deletion. Beyond legal jurisdiction it explicitly includes the technical and organisational ability to actually enforce that control.
Legal control describes jurisdiction and decision-making authority over data. Data sovereignty goes further and includes practical enforceability. In everyday usage, however, the two are largely treated as synonyms.
Digital sovereignty is the umbrella term and covers self-determination in the digital sphere as a whole, including infrastructure, platforms, standards and skills. Data sovereignty is the sub-area that concerns the data itself.
No. The storage location only answers the question of data residency. Access additionally depends on which legal system the operator is subject to. In June 2025 a Microsoft France representative told a French Senate inquiry under oath that he could not guarantee data would never reach US authorities without consent.
Chapter VI of the Data Act obliges providers to remove switching obstacles, provide open interfaces and make data exportable in a commonly used machine-readable format. Charges for switching, including the data egress it involves, disappear entirely from 12 January 2027. Until then providers may charge the direct costs actually incurred. Normal egress costs in day-to-day operation are not affected.
C3A stands for Criteria enabling Cloud Computing Autonomy and was first published by the German Federal Office for Information Security on 27 April 2026. It assesses whether a cloud offering can be used self-determinedly in a given risk context and presupposes compliance with the C5 requirements. C3A is a procurement framework, not a regulatory obligation.
Gaia-X did not become a European cloud provider but a trust and compliance framework for data spaces. The German funding projects were concluded in April 2025. For a concrete software selection decision, Gaia-X currently provides no practically usable seal of approval; C5 and C3A are the more relevant reference points.
A larger one than in pure infrastructure decisions, because a PIM or MDM holds the genuinely valuable data: product attributes, prices, supplier relationships, engineering and compliance data. Three verifiable points decide the outcome: the completeness of the data export, freedom of choice in the operating model, and the replaceability of the AI model provider.
Not only master data but also history and version states, relationships and references, classification trees, media assets with metadata, workflow configuration and the roles and permissions model. All of it in documented, open formats and at no additional cost. A reproducible test export belongs in the tender.
According to the Bitkom Cloud Report 2026, 43 percent of the companies surveyed say no equivalent European alternatives currently exist for their requirements. At the same time 91 percent would prefer German providers. The gap therefore exists, but it has narrowed and varies by use case.
