Data residency and data sovereignty sound like the same thing. They aren’t, and the gap between them is exactly what regulators, auditors and boards are now asking about.

Why sovereign cloud is suddenly everywhere

Six months ago, sovereignty was a slide in a procurement pack. Three months ago, a regulator asked a compliance team to evidence exactly which jurisdiction their data could legally be accessed from. Last week, someone on the board asked whether the company’s cloud provider could ever be compelled to hand over data by an authority or jurisdiction the company has no relationship with.

It isn’t that sovereign cloud is new. It’s that the question underneath it, “who can actually reach our data, and under which jurisdiction’s law”, has become impossible to wave away. Gartner forecasts worldwide sovereign cloud infrastructure spending at around $80 billion in 2026, and that number is being driven by exactly this: organisations finding out, often during an audit or a contract renewal, that their assumptions about where their data sits, and who can reach it, don’t hold up.

Residency is not sovereignty

Here’s the misconception that catches most organisations out: hosting data in a local, in-region data centre satisfies data residency requirements, and residency is treated as a proxy for sovereignty. It isn’t.

If the provider running that regional data centre is incorporated somewhere else entirely, extraterritorial legislation in that other jurisdiction can still compel it to produce data under its control, wherever that data is physically stored. A landmark European court ruling made the same point from the other direction: contractual promises that data “won’t” be accessed aren’t the same as a legal and technical guarantee that it can’t be. Rules on recognising foreign disclosure orders add a further wrinkle, since such a request is typically only recognised in the EU if it rests on a proper international agreement, and in many cases no such comprehensive agreement exists.

Put simply: a local address on your data centre tells you where your servers are. It doesn’t tell you who can legally force you to open them.

Where the real differences sit

Not every organisation needs the same answer, and that’s the point of having options rather than one mandated approach. In practice, there are three distinct levels of protection worth understanding:

• Regional hosting — data stored in a local data centre, but operated by a company incorporated in a different jurisdiction. This satisfies data residency and is a strong, well-accredited choice for most workloads, but it does not remove exposure to that other jurisdiction’s laws.

• Regional sovereign cloud — infrastructure that is physically and logically isolated from the rest of a global provider’s network and operated entirely by resident personnel in that region, so operational control, support and incident handling stay local, even where the parent company is headquartered elsewhere.

• Fully independent sovereign hosting — infrastructure owned and operated by a provider with no ownership ties outside a single, chosen jurisdiction, running exclusively from data centres there. Switzerland is a clear example: Swiss-owned providers sit outside both EU jurisdiction and the reach of other countries’ laws, while still aligning closely with GDPR and Switzerland’s own data protection law (nDSG).

It’s worth noting that major hyperscalers are moving fast here too. Some have invested heavily in building their own regional sovereign offering, with the explicit intention of letting organisations operate entirely independently within that region. For many customers that will be more than enough. Others are still forming their own view on how much assurance a single global provider’s regional offering, however well engineered, can give them, which is exactly why having a genuinely separate, independently owned alternative matters for anyone wanting a second, independently audited option.

None of this makes regional hosting the “wrong” choice. For the large majority of workloads, a well-accredited regional offering from an established provider remains a strong, cost-effective, highly available option, and will continue to be the right default for most customers. The distinction matters for a specific, growing category of data: the most sensitive regulated content, where a regulator, a client contract, or a board wants proof, not just an assurance, of where legal reach stops.

Why this can’t wait

A few forces are converging at once, which is why “we’ll look at sovereignty next year” is becoming a harder position to defend:

• DORA, in force since January 2025, requires financial entities to secure audit rights, incident notification timelines and concentration risk disclosure from their ICT providers, terms that standard cloud SaaS agreements often don’t offer by default.

• NIS2 extends operational resilience and reporting obligations across a much wider set of regulated and critical sectors, with the same underlying question: can you evidence who controls your infrastructure?

• The EU Data Act changes the economics of switching providers, with cloud-switching charges being phased out from 2027. Boards planning a multi-cloud or sovereign strategy now know that exit costs will fall, making a move far less risky than it would have been a few years ago.

• Patient data, clinical study data and other special-category information under GDPR Article 9 carries its own elevated bar, one that is increasingly hard to justify to both regulators and patients on infrastructure with unresolved jurisdictional exposure.

None of this is about distrust of any particular cloud provider. It’s about the fact that “we host in the region” used to be a sufficient answer, and for a specific, growing set of use cases, it no longer is.

What a real answer looks like

Genuine sovereignty isn’t a single checkbox, it’s a combination of three things holding together: legal sovereignty (the provider isn’t subject to foreign disclosure laws), operational sovereignty (the people who can access your environment are based in, and employed by, your chosen jurisdiction), and, increasingly, cryptographic sovereignty (encryption keys are held and managed in that jurisdiction too, not just the data they protect).

That’s a meaningfully different bar to “our regional data centre is ISO 27001 accredited”, and it’s why more organisations are now looking for a hosting option, alongside their existing cloud estate, that can actually meet it when the use case calls for it.

The choice ahead

Organisations handling regulated data aren’t really asking whether sovereign hosting matters any more, most have already concluded it does for at least some of their content. The question is whether they adopt it as a deliberate, evidenced choice for the data that needs it, or discover the gap the hard way, during an audit, a tender, or a regulator’s question they can’t fully answer. Generis is launching CARA on sovereign cloud options from early 2027.

You can read our press release on the topic here.