Europe’s Cloud Exit: Why Businesses Are Moving Data to Sovereign and Private Clouds

In short: keeping data inside EU borders is necessary but not sufficient. What decides who can get at your data is who operates the infrastructure, which country’s courts can reach that operator, who holds the encryption keys, and whether you can leave. In 2026 the EU began writing those questions into its own procurement rules, and companies such as Airbus and public bodies such as France’s Health Data Hub are already acting on them.

What happened: Europe’s cloud wake-up call

Data sovereignty used to be a topic for regulators and public-sector buyers. Over the past eighteen months a string of events moved it into ordinary boardrooms. The milestones, with the sources listed at the end of this article:

Why an EU region is not the same as EU sovereignty

The hyperscalers have spent years building data centers in Frankfurt, Paris, Dublin and Amsterdam, and keeping data there does solve the residency question under GDPR. It does not solve the jurisdiction question. The US CLOUD Act of 2018 requires providers under US jurisdiction to disclose data responsive to valid US legal process “regardless of where the company stores the data”, in the words of the US Department of Justice. The Justice Department adds that this jurisdiction is not limited to US-headquartered companies; it depends on the facts.

That is why the June 2025 hearing in the French Senate landed so hard. Asked whether he could guarantee that French citizens’ data would never be passed to US authorities without French consent, Microsoft France’s legal director answered: “No, I cannot guarantee it,” while stressing that it had never happened. It was an honest answer, and it describes every US-owned provider, not only Microsoft.

The legal ground for sending personal data to the US is also less stable than it looks. The EU-US Data Privacy Framework survived a first challenge in September 2025, when the EU General Court dismissed the Latombe case; an appeal is pending at the Court of Justice. The framework leans on US oversight bodies, and those have weakened: the Privacy and Civil Liberties Oversight Board has lacked a quorum since three members were removed in January 2025, and on 29 June 2026 the US Supreme Court ruled in Trump v. Slaughter that the president can remove FTC commissioners without cause. The privacy group noyb, which counts 259 references to FTC independence in the adequacy decision, asked the Commission to repeal it, and the European Data Protection Board formally asked the Commission to assess the ruling’s impact. Meanwhile the US surveillance law at the heart of the original Schrems rulings, FISA Section 702, lapsed as a statute on 12 June 2026, but collection continues under a court approval valid until March 2027, NPR and the Brennan Center report.

The hyperscalers have responded with “sovereign” offerings. The AWS European Sovereign Cloud, live since January 2026 with €7.8 billion of investment, runs through EU legal entities under German law with EU-resident staff. Microsoft has completed its EU Data Boundary, launched sovereign public and private cloud options, and in April 2026 said it had committed contractually to contest in court any order to suspend its cloud operations in Europe. Google offers sovereign tiers through partners such as S3NS, its joint venture with Thales in France. These are real improvements in operational control. They do not change ownership: as Forrester’s Dario Maisto told The Register, the AWS offering is “still entirely owned by the US mother company”, which limits its immunity from the CLOUD Act. When the Commission scored providers for its own sovereign cloud tender, the Google-linked bid reached only the minimum sovereignty level.

The rules now pushing companies to act

No single EU law tells a private company to host only in Europe. But several rules now make dependence on one foreign provider harder to justify and easier to escape:

Reliability: the concentration risk nobody priced in

With three US companies holding about 70% of Europe’s cloud market, a bad day at one of them becomes a bad day for thousands of European businesses at once. On 19 and 20 October 2025 a race condition in DynamoDB’s DNS automation took down AWS’s US-East region for about 14.5 hours; in the UK, Lloyds and HMRC were among those hit. On 29 October a configuration change broke Azure Front Door, taking Asda, Marks & Spencer and Dutch Railways offline. “Systemic risk is fragility caused by concentration,” the CEO of the European cloud provider Civo told The Register afterwards. In July 2026 a power fault took a Google Cloud zone in the Netherlands down for nearly 15 hours, and at the end of August a global Microsoft 365 authentication failure disrupted email and Teams for several days.

The lesson is not that private or European clouds never fail; every data center can. It is that resilience comes from design you control: workloads spread across at least two sites, backups you have restored, a documented way to fail over, and an exit plan that works. That is much easier to build when you own the architecture than when your critical systems depend on a single global control plane.

Market reality: demand is rising, but few are leaving entirely

Synergy Research Group puts European providers’ share of their home market at about 15%, down from 29% in 2017 and flat since 2022; the largest, SAP and Deutsche Telekom, hold about 2% each. Sentiment is moving faster than market share. In Bitkom’s 2026 cloud report, 85% of German companies say the country is too dependent on US cloud providers, 64% say US policy is pushing them to rethink their cloud strategy, and while 71% use a US provider, only 8% say they would prefer one. A Gartner survey of 241 Western European CIOs found that 61% expect geopolitics to increase their reliance on local cloud providers.

Money is following. Gartner forecasts sovereign cloud infrastructure spending in Europe to rise from $6.9 billion in 2025 to $12.6 billion in 2026 and $23.1 billion in 2027. European providers are investing to meet it: Deutsche Telekom and Nvidia opened an industrial AI cloud in Munich in February 2026, Schwarz Digits, the owner of STACKIT, is building an €11 billion AI data center in Brandenburg, and OVHcloud reported public cloud revenue growth of more than 20% in its latest quarter. Capacity is not free, though: Hetzner raised prices twice in 2026 as memory and storage costs climbed.

Real moves are under way. Airbus picked Scaleway for about 70 critical applications by the end of 2028. France is moving its Health Data Hub to Scaleway and replacing Zoom and Teams with its own Visio for 2.5 million civil servants by 2027. Schleswig-Holstein has moved more than 40,000 mailboxes off Microsoft Exchange, and the Dutch government signed its first framework deal with a European cloud, STACKIT, and blocked the sale of the company that hosts its DigiD login system to a US buyer, citing the CLOUD Act. Yet IDC found that only 4% of European organizations plan to use local providers exclusively. The pattern is hybrid: sensitive and critical data moves under European control, while global and commodity workloads stay where they run best.

Hyperscaler, sovereign or private cloud? How to choose per workload

Execution decides whether sovereignty feels like progress or punishment. When the European Commission rolled out a self-hosted messaging tool as a “sovereign back-up to Teams” in 2026, Politico reported harsh reviews from its own staff. Users judge a migration by whether their work gets easier or harder, so plan the user experience as carefully as the data center.

How RHC Solutions keeps your data in Europe, secure and reliable

RHC Solutions has helped businesses run, secure and recover critical infrastructure since 1994, with teams in Lisbon, Sofia and Larnaca inside the EU. We work with European providers such as OVHcloud as well as AWS, Azure and Google Cloud, so we can recommend the right home for each workload rather than a single platform. We start with a sovereignty assessment of your data flows, jurisdiction exposure and exit costs; design private and sovereign cloud environments in European data centers, connected to the hyperscalers where they still make sense; migrate in phases with minimal downtime; and then keep it running with 24/7 operations, managed security, tested disaster recovery across sites, and the evidence your GDPR, NIS2 and DORA audits need.

In the news: sources and further reading