DORA and its impact on data sovereignty

The Scale of Europe's Data Ambition

According to the European Commission, data is 'immensely valuable to all organisations, a significant resource for the digital economy and the cornerstone of our EU industrial competitiveness'. The data economy is projected to deliver more than €829 billion and nearly 11 million jobs to the region by 2025. To capture this value, the EU has committed €1.8 trillion in research, innovation, regulations, policies and standards – a scale of investment that signals an expectation of substantial returns.

This level of financial commitment underscores the EU's determination to position itself as a global leader in the data-driven economy, ensuring that European businesses can compete effectively in an increasingly digital world while maintaining strategic autonomy over critical information assets.

DORA and the Expanding Regulatory Perimeter

The Digital Operational Resilience Act (DORA) marks a significant shift by extending regulatory scope beyond financial institutions to encompass their entire supply chains – all integrated businesses and services. DORA aligns with the EU Cybersecurity Certification Scheme (EUCS) and may become mandatory for highly critical sectors under the Networks and Information Systems Directive 2 (NIS2) from 2024. Subsequent legislation, including updates to the Cybersecurity Act and the Data Act, will reinforce this framework. A defining feature is the introduction of local auditors to verify compliance, moving beyond self-attestation to enforced accountability.

By requiring organisations to demonstrate resilience not just internally but across their extended ecosystems, DORA addresses systemic risks that could propagate through interconnected financial and digital infrastructures, thereby strengthening the overall stability of the European economic landscape.

Regional Protectionism and the Sovereignty Imperative

Globally, 145 countries now have data privacy laws, up from 132 in 2018. This proliferation, combined with regulations such as EUCS, the AI Act and the Data Act, is creating an environment of regional 'protectionism' centred on data ownership and control. The EUCS draft now includes a High+ category stipulating that no entity outside the EU may have effective control over cloud data. For organisations, this translates into complex compliance requirements across jurisdictions, driving demand for local expertise and multi-cloud strategies. IDC research indicates over 70% of businesses expect financial and environmental regulations to become greater threats, while 88% of boards view cybersecurity as a business risk – all amid macro pressures including inflation, geopolitical instability and the UN's triple crisis of climate change, pollution and biodiversity loss.

This fragmented regulatory landscape necessitates sophisticated approaches to data governance, as organisations must navigate varying legal requirements while ensuring consistent protection standards across their operations, ultimately reinforcing the strategic importance of building sovereign-capable infrastructure.

Cloud Concentration and the Case for Sovereign Infrastructure

The urgency is measurable: 64% of EMEA organisations have increased their volume of sensitive cloud-hosted data, and 63% already store confidential or secret data in public clouds. Yet 95% cite unstructured data management as a business problem, and 42% of leaders are very or extremely concerned about critical data managed by U.S. cloud providers – a concern grounded in the fact that U.S.-based providers control 66% of the European cloud market and are subject to extraterritorial laws such as the U.S. Cloud Act. Data sovereignty – binding data to the privacy laws and governance structures of its nation, sector or organisation – has become a boardroom priority. However, many multinational cloud providers cannot guarantee that a cloud endpoint offers the same sovereign protections as the original data location.

This dependency creates a strategic vulnerability where critical European data may be subject to foreign legal processes, undermining both privacy expectations and operational control, which has prompted urgent calls for infrastructure that can guarantee jurisdictional integrity regardless of where data is physically stored or processed.

A 'Cloud Smart' Strategy for Resilience

Resilience requires a 'Cloud Smart' approach: flexibility to move business-critical systems between providers without extended outages or data leaving sovereign zones. The political agreement on the Data Act (27 June 2023) aims to remove legal, financial (egress fees) and technical barriers to cloud switching. True resilience also demands multi-cloud and hybrid architectures – single-vendor dependence is incompatible with operational continuity. Audits must verify that all components, including sovereign supply chains under DORA, meet consistent operational resilience standards. Copying data out of a sovereign zone or lacking a secondary site introduces unacceptable risk.

This strategy emphasises architectural agility and contractual foresight, enabling organisations to respond dynamically to changing geopolitical, regulatory, or technical circumstances while maintaining continuous compliance with evolving sovereignty requirements across all operational layers.

Foundations of a Sovereign Europe

Ultimately, sovereignty enables innovation. The legislative framework now taking shape is not merely protective; it is designed to meet and exceed the Commission's €829 billion projection. These regulations are the building blocks for a future Sovereign Europe – one where control over data translates into control over economic destiny. Organisations that embed resilience and sovereignty into their digital strategies today will be positioned to lead in the data economy of tomorrow.

By establishing trustworthy foundations for data governance, the EU aims to unlock the full potential of its digital economy, fostering an environment where innovation can flourish not despite regulatory oversight, but because of the confidence and stability it provides to businesses operating within clearly defined, protected parameters.

What this means

The EU's regulatory architecture – DORA, EUCS, the Data Act, NIS2 and the AI Act – forms a coherent strategy to reclaim control over the continent's data destiny. With €1.8 trillion invested and an €829 billion return projected, these measures are economic infrastructure as much as legal frameworks. Organisations that treat data sovereignty as a strategic capability rather than a compliance burden will gain competitive advantage in the emerging data economy. The future belongs to those who can operate resiliently within sovereign boundaries while innovating freely within them.