Digital sovereignty: why organizations are losing control over their data

Digital sovereignty has rapidly become a topic that is no longer confined to IT, but is increasingly on the agenda of boards and management. Organizations realize that dependence on technology and vendors has a direct impact on continuity, compliance, and risk. The question is no longer whether this topic is relevant, but how you as an organization deal with it in practice.

Data is everywhere, but control is lacking

In practice, we see IT landscapes becoming increasingly complex. Data is scattered across cloud platforms, SaaS solutions, on-prem systems, and integrations with external parties. This chain is becoming longer, less visible, and therefore harder to manage.

For example, we see healthcare organizations where patient data is spread across multiple systems and links, making it difficult to gain precise insight into where that data is located and who has access to it. Or government organizations that are increasingly asked: can we actually explain where our data is stored and which legislation applies to it?

The real problem: no framework for choices

Many organizations have the technology but lack a clear framework for making choices. Cloud-first is often seen as a strategy, while in reality, it is a cumulative result of previous decisions. IT, security, and management each look from their own perspective, making it difficult to align. As a result, digital sovereignty remains abstract, while it actually requires concrete choices.

There is no standard solution, only a trade-off

Digital sovereignty is not a choice between “everything in the cloud” or “everything on-prem.” It is about making conscious choices based on risk, dependency, and continuity. In practice, this means that different parts of your IT landscape require different choices.

For instance, we see organizations that move their workplace environment and collaboration entirely to Microsoft 365 because speed, flexibility, and ease of use are the top priorities there. At the same time, these same organizations choose to organize critical data or backups differently because they want to be less dependent on a single platform.

Another example is a logistics organization that is heavily dependent on real-time data and systems. For them, availability is crucial. They often choose to run their operational systems in the cloud for scalability but design their recovery strategy so that they can be operational again quickly even if a platform fails.

In sectors such as healthcare or financial services, we see a different trade-off. There, compliance, auditability, and data access play a larger role. Organizations must be able to demonstrate where data is located, who can access it, and how recovery is set up. This often leads to choices where more control is built into specific parts of the landscape.

These types of choices show that digital sovereignty is not a technical discussion, but a strategic trade-off. Not everything has to be in the same place, as long as you as an organization make conscious choices and can explain and justify those choices.

The first move toward control

Organizations are looking for ways to regain that control. In practice, we see various directions emerging. Some organizations choose to remain entirely in public cloud environments such as Azure or AWS because speed, scalability, and integration are the most important factors there.

Other organizations seek more control and independence, for example, through private or on-prem solutions. And specifically regarding data storage and recovery, we see that organizations sometimes opt for specialized solutions, such as FAST LTA, when control and recoverability are central.

The fact that this issue is becoming increasingly concrete is also reflected in the market. For example, assessment frameworks have now been developed to help organizations gain insight into their dependencies and risks, such as the cloud sovereignty assessment tool from DICTU.

From insight to action

Many organizations feel they need to do something but don’t know where to start. The topic is often already on the agenda. There are discussions about risks, dependencies, and legislation. Sometimes an audit has taken place or the request comes from the board. Yet, it often remains at the insight stage.

The challenge is not in recognizing the problem, but in translating it into concrete choices. In practice, we see organizations getting stuck here because everything is interconnected. A choice for a cloud platform directly affects data storage and recovery. And it is precisely these components that determine how dependent you are and how quickly you can respond to incidents. This creates doubt: where do you start without losing sight of the big picture?

The organizations that make progress in this area do not start with technology, but with getting a clear picture of their risks and dependencies. From there, direction emerges—and choices in architecture and solutions become more logical and better substantiated.

From awareness to first choices

On Tuesday, May 12, from 1:30 PM to 2:30 PM, we are hosting a webinar showing how organizations take the step from insight to concrete choices in their IT architecture.

This webinar is particularly relevant for CIOs, CISOs, IT managers, and architects within organizations where IT is business-critical and where questions arise regarding data control, vendor lock-in, and increasing compliance requirements.

We will discuss where organizations lose control in practice and how to make digital sovereignty concrete. We will also show how organizations implement this in their architecture, for example, in situations where more control over data storage and recovery is needed and solutions like FAST LTA can play a role.

Register for the webinar and gain insight into where to start!