Digital sovereignty
Digital sovereignty is the ability of a state, a company or a public body to control its own data, infrastructure and software without being subject to dependence on, or interference from, a foreign player or a foreign legal system. For an organization, it rests on four pillars: where the data is located, which law applies to the provider, who controls operations and access, and reversibility, meaning the ability to leave. It is also called cyber sovereignty or, in EU texts, tech sovereignty.
Definition and pillars of digital sovereignty
The term has no legal definition. In 2019, a French Senate commission of inquiry summed it up as the “State’s capacity to act in cyberspace” (Senate report no. 7, 2019-2020, in French). It has since been extended to companies and public bodies that entrust their data and services to providers, for whom the question becomes very concrete: which players do they depend on, and what happens on the day that dependence becomes a problem? Being sovereign does not mean aiming for self-sufficiency, though: the point is to keep the freedom to choose one’s providers and to have credible alternatives, not to build everything in-house.
For an organization, each of the four pillars comes down to one precise question.
- Location: in which country the data is stored and processed.
- Jurisdiction: which law can compel the provider. The US CLOUD Act, for example, requires a provider subject to US law to disclose the data it holds, even when that data is stored outside the United States (18 U.S.C. § 2713).
- Operation: who administers the service and who holds the access rights.
- Reversibility: the ability to leave with your data in a usable format. Since 12 September 2025, the EU Data Act has governed switching between cloud providers (Regulation (EU) 2023/2854).
In France, the Digital Sovereignty Observatory, launched in January 2026 under the High Commission for Strategy and Planning, follows the same logic: it uses a questionnaire to measure how dependent French organizations are on non-European solutions (launch announcement, in French). For hosting, the SecNumCloud qualification issued by ANSSI, the French national cybersecurity agency, adds criteria for protection against non-European law to its security requirements (requirements baseline v3.2).
The issue extends beyond Europe: in Canada, the federal government launched Digital Transformation Canada in September 2026, an organization whose priorities include strengthening the country’s digital sovereignty and security (Prime Minister’s news release).
Digital sovereignty, data sovereignty and sovereign cloud: the differences
Data sovereignty means that data remains subject to the laws of the country where it is collected or processed, whereas data localization only tells you where the data is stored.
Digital sovereignty goes further, since it also asks which law the provider operates under, who administers the service and how you can leave. Data hosted in France by a provider subject to US law is located in France, but it is not shielded from a request made under the CLOUD Act. The on-premise vs cloud hosting glossary entry covers this point from the infrastructure side.
A sovereign cloud covers only one layer of this whole, the infrastructure that hosts the services, whereas digital sovereignty covers the entire chain: the software running on that infrastructure, the vendor that maintains it and the third-party services it calls. Software can therefore run on a sovereign cloud and still depend on a component hosted elsewhere.
Digital sovereignty audit: where to start
A website or portal rarely relies on a single service: behind the CMS there is often a site search engine, an analytics tool, a personalization engine, a content delivery network (CDN), an email delivery service and an AI model provider. Each of these components can have its own host, its own jurisdiction and its own sub-processors. A CMS hosted in France can therefore call a search or personalization service processed in another country.
A digital sovereignty audit is an assessment of an organization’s dependencies: it examines each component along with its provider and contract, and can start from three documents. The first is the list of sub-processors, which Article 28 of the GDPR makes subject to the controller’s authorization (Regulation (EU) 2016/679), with the legal entity and processing location for each. The second is the diagram of data flows between components, and the third covers the reversibility clauses, which specify the export format and timeframe. An answer such as “your data stays in Europe” that does not say which component it refers to is not enough to draw a conclusion.
Frequently asked questions
What are the pillars of digital sovereignty?
For an organization, digital sovereignty rests on four pillars: data location, the law that applies to the provider, control over operations and access, and reversibility. At state level, two more are added: industrial capacity, from cloud to semiconductors and artificial intelligence, and the ability to enforce its own rules on digital players.
Is hosting data in Europe enough to guarantee a website’s digital sovereignty?
No, hosting data in Europe settles where it is located, but not which law applies to the provider. If the host or one of its sub-processors is subject to US law, the CLOUD Act requires it to disclose the data it holds, wherever that data is stored. You also need to check the website’s third-party components, such as search, analytics or personalization, which may be processed somewhere other than the CMS itself.
Is an open source CMS automatically sovereign?
No, an open source CMS is not sovereign by default, even though open code makes auditing and reversibility easier, since no one can take the software away from the organization using it. Sovereignty also depends on where the CMS is hosted, who operates it and which third-party services it calls. An open source CMS run by a provider subject to foreign law raises the same questions as proprietary software. The open source vs proprietary CMS glossary entry compares the two models.
How do you include digital sovereignty in an IT RFP?
Digital sovereignty is built into an IT RFP by translating it into verifiable criteria: the jurisdiction of each provider and sub-processor, the processing location of each component, who holds administrative access, and the data export format and timeframe. These criteria can serve as eligibility conditions or count toward the score. Our article on the 8 criteria provides a complete grid.
What is the difference between French and European digital sovereignty?
French digital sovereignty refers to the ability of the French state and French organizations to control their dependencies. The European version pursues the same goal at EU level, with shared legislation such as the GDPR and the Data Act, and a tech sovereignty policy led by the European Commission. France and Germany held a summit on European digital sovereignty in Berlin on 18 November 2025, and in June 2026 the Commission adopted a Tech Sovereignty package that extends this policy. ANSSI’s SecNumCloud requirements baseline (version 3.2 of 8 March 2022) also works at this scale, since it requires the provider’s registered office, central administration and principal place of business to be located in an EU member state.
Resources that cover this term
Loading resources and related terms…