why is it needed and how to use it
The sovereign cloud is not a new concept, but it has become especially relevant now due to the changing geopolitical landscape and new rules that affect data control. In essence, the sovereign cloud represents a smart solution to the international battle for digital sovereignty, but let’s dig a little deeper.
Behind the drive to make clouds sovereign is the need for digital sovereignty. In practice, it’s all about the data: you need to understand where it is, where it is transferred, and who controls it. These questions are critical to today’s data economy. In the context of this issue, cloud services are inevitably in the spotlight, because they are the data driven economy.
What are the benefits of a sovereign cloud
Sovereign cloud as a term does not have an unambiguous definition, but it is widely used in the industry. This concept is based on data, their ownership, trust, control, regulation and national interests of the state.
Such a cloud stores all data, including metadata, on the territory of a sovereign state and prevents foreign access to them. It creates a trusted environment for storing and processing data that can never be transferred abroad and must remain under the jurisdiction of one country.
Sovereign clouds aim to protect and unlock the value of critical data. They also have all the main advantages of cloud computing: flexibility, security and automation.
Ideally, a sovereign cloud should be part of a multi-cloud infrastructure strategy because not all data is the same and there are differences between clouds too. Each cloud service has its own advantages, and it is better to use them in parallel. Therefore, it is important to rethink an organization’s cloud computing strategy to meet today’s regulatory requirements.
How to close the legal gap in cloud regulation
European enterprises and public sector organizations store more and more data in virtual data centers. As you know, this market segment is controlled by American technology giants. But there is a legal gap in the regulation of cloud services. This was primarily influenced by the US Cloud Services Act (Cloud act) and similar laws in other countries (eg China). They are contrary to the new EU rules and decisions of the European Court, in particular, the precedent case, called Shrems II.
The European Union wants to reduce the dependency and risk of foreign access to critical data, given that the cloud is a source of artificial intelligence and other important technologies. EU rules such as GDPRthe Data Act and the Data Management Act are designed to control the flow of data across borders to prevent the risk of access to data by representatives of other states.
In particular, the rules require that sensitive or sensitive data remain in sovereign territory. This is emphasized in Shrems II solution. As a result, data privacy directors now need to understand and evaluate what data is stored in the cloud and whether any of it is transferred outside the EU.
The amount of metadata that cloud providers collect is much more than people think. Collection is often automatic and may include data such as IP addresses, credentials, and logs and diagnostic reports, so you must:
conduct a thorough classification of data and evaluation of applications to ensure compliance. Organizations must deploy the right applications and data in the right cloud, whether private, hybrid or public;
distinguish which data can be classified as critical according to national and regional security standards. First, there are different levels of classification, such as public, sensitive, or restricted data, which vary by country or region. Secondly, there are various types of industry data such as national, corporate or personal data. That’s why the first thing to do is to fully evaluate the data and applications.
Five Best Practices for Sovereign Cloud
Classify the data. For critical and sensitive, minimize all risks, including issues of sovereignty and foreign access.
Hire a data protection specialist on staff.
Conduct a data protection impact assessment (DPIA) before moving to the cloud.
Deploy your data and workload to the right cloud.
Consult with a multi-cloud solution specialist.
First of all, digital sovereignty is the right of nations, organizations and citizens to control their digital autonomy and their data. Sovereign cloud infrastructure is connected “backbones”. They are essential to unleash the full potential of the data-driven economy and drive innovation in society through digital technologies.
Digital ecosystems must thrive through collaboration and open access to data centers of common architecture. The values of openness, trust and transparency and inclusiveness that we are proud of in the Nordic countries deserve to be guaranteed through digital empowerment.
