What "sovereign" means in practice

The word covers three different questions, and it helps to keep them apart. Data residency asks where your data is stored and processed. Operational control asks who can administer the systems and see the data, and with which keys. Jurisdiction asks which laws can reach the provider that runs the service. A workload can be stored in Paris and still raise a jurisdiction question, and the reverse is also true. A good design answers each question on purpose.

What GDPR changes in the architecture

GDPR does not name a cloud provider or a region. It asks you to know where personal data goes, to have a lawful basis and a contract with each processor, to protect it appropriately, and to be able to show how. In architecture terms that means a few concrete things:

  • a clear map of which services hold personal data, and in which region;
  • encryption in transit and at rest, with keys you control;
  • access limited to the people who need it, with logs you can produce;
  • backups, logs and disaster recovery that do not quietly leave the region you chose;
  • a list of the processors and sub-processors you rely on.

Regions as guardrails on GCP, AWS and Azure

Choosing an EU region when you create a project is not enough: someone will, sooner or later, create a resource somewhere else. Make the rule enforceable at the top of the organisation, as code:

  • GCP: an organisation policy that restricts resource locations to the EU regions you allow.
  • AWS: a service control policy that denies requests to regions outside your allow-list, with the few global services handled explicitly.
  • Azure: an Azure Policy assignment for allowed locations on the management group.

Treat these as part of the landing zone from day one, in the same Terraform that creates your projects, accounts or subscriptions. Our article Build the landing zone before the first workload explains why that order matters.

Keys and access

Encryption only helps sovereignty if you control the keys. All three providers offer customer-managed keys in their key management service, and some offer ways to hold the key material outside the provider. Decide per data class which level you need, then enforce it with policy. For access, use single sign-on, short-lived credentials instead of stored keys, least-privilege roles and a documented break-glass procedure. Send audit logs to a store in the EU that administrators of the workload cannot edit.

The jurisdiction question

Providers headquartered outside the EU can be subject to the laws of their home country, which is the reason some organisations prefer European providers for their most sensitive data. Transfers to the United States can rely on the EU-US Data Privacy Framework adopted in 2023, and some organisations still add their own safeguards on top. Whether that is enough for a given dataset is a legal and risk decision. Take it to your data protection officer or counsel, and bring them a clear architecture to review.

The French context

In France, the national cybersecurity agency ANSSI runs the SecNumCloud qualification for cloud providers. For some public-sector and particularly sensitive workloads, a qualified offer may be required or expected, which can rule out some regions and services. If you are in that situation, check the requirement for your data first: it decides which of the options above are open to you at all.

A landing zone checklist

  1. An organisation structure with separate production and non-production, owned by named teams.
  2. A region allow-list enforced by organisation-level policy.
  3. Customer-managed keys for personal and sensitive data.
  4. Single sign-on, least privilege, no long-lived keys, a tested break-glass account.
  5. Audit logs and backups kept in the EU, protected from deletion.
  6. Disaster recovery across EU regions, tested.
  7. A register of processors and sub-processors, kept up to date.
  8. Everything above written as code, reviewed and versioned.

How we help

LineXa is a French cloud consultancy. If you are designing or reviewing a European landing zone, you can book a GDPR-Aware Cloud Landing Zone Design and Architecture Review, or a Secured Cloud Infrastructure Review and Hardening Audit for AWS, Azure and GCP. We work on the engineering side and recommend that your data protection officer or counsel owns the legal decisions.