Technology decisions have traditionally been driven by functionality, price, and ease of use. If a solution met the business need and integrated with existing systems, it was usually considered the right choice. Who owns the service provider and which legal jurisdiction governs rights to the service rarely features in procurement discussions.
That is beginning to change.
Questions around digital sovereignty are moving out of the IT department and into the boardroom. Organisations are asking not just where their data is stored, but who ultimately has access to it, which laws apply to it and whether they have sufficient control over one of their most valuable business assets.
This isn’t about fearmongering or suggesting organisations should abandon cloud technology. It’s about recognising that convenience and control are not always the same thing.
Recent research commissioned by Veeam highlights just how conflicted organisations have become. While 99% of enterprise decision-makers across EMEA believe data sovereignty is important, almost three-quarters admit it is being pushed aside in favour of rolling out AI more quickly. The report also found that UK organisations are particularly aware of the risks, with almost half identifying AI data as their biggest visibility gap.
Those findings tell an interesting story.
Business leaders understand that data matters. They understand that governance matters. Yet when commercial pressures, innovation and speed enter the equation, sovereignty is often viewed as something that can be addressed later.
The problem is that later tends to arrive much sooner than expected.
As organisations embrace AI, expand supply chains and collaborate with more external partners, they are generating and sharing more information than ever before. Every one of those interactions raises a simple question: Do you know where your data is actually going?
Many organisations assume that because they are headquartered in the UK, their information remains there as well. In reality, that is not always the case. Data may be processed, routed or accessed through multiple jurisdictions before it reaches its destination. For most users, this happens invisibly, but that does not mean it is irrelevant.
Jurisdiction matters because different countries operate under different legal frameworks. Organisations can spend considerable time ensuring they comply with UK legislation, only to discover that the technology they rely on is subject to overseas laws and obligations beyond their control.
For businesses operating in regulated sectors, that should not be viewed as a technical issue. It is a governance issue.
Boards spend significant time discussing operational resilience, supply chain risk and business continuity. Digital sovereignty belongs in the same conversation because it ultimately comes down to trust. Can you confidently explain where sensitive information resides, who could potentially access it and which legal framework applies if questions are ever asked?
Increasingly, customers are asking those same questions of their suppliers.
This is particularly relevant as organisations review their technology supply chains. The conversation is no longer simply about whether a service is secure. It is also about who owns it, who supports it and where accountability sits.
That is why British organisations should not be afraid to ask whether British-built security offers advantages beyond compliance.
Choosing a UK-owned provider is not about turning away from international innovation. Nor is it about suggesting overseas technology cannot be trusted. It is about recognising that organisations handling sensitive information may benefit from working with suppliers operating under the same legal framework, the same regulatory environment and the same expectations around governance.
Digital sovereignty should be viewed as both a commercial and ethical principle.
Commercially, organisations gain greater confidence over how sensitive information is handled and where responsibility sits. Ethically, they are demonstrating to customers, partners and stakeholders that they have carefully considered how information is managed throughout its lifecycle, rather than simply accepting the default settings of a global platform.
Convenience has undoubtedly driven much of the digital transformation we’ve seen over the last decade. Cloud platforms have enabled organisations to scale quickly, collaborate more effectively and embrace flexible ways of working. None of that should be dismissed.
However, convenience should not replace informed decision-making.
Asking where data is stored is no longer enough. Organisations should also understand where it travels, which countries it passes through and which legal frameworks may apply along the way. These questions become even more important as AI systems consume increasing volumes of business data and organisations seek to demonstrate greater accountability for how that information is used.
Digital sovereignty is unlikely to become the deciding factor in every technology purchase. Nor should it. Functionality, security, value and usability will always remain important considerations.
But sovereignty deserves a place alongside them.
Digital sovereignty isn’t about creating unnecessary barriers or avoiding global technology providers. It’s about making informed decisions. Businesses should know where their data is, who could potentially access it and what that means for their organisation. Those conversations are becoming an increasingly important part of good governance.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.