Our approach
The assessment consists of five steps and takes one week. We tailor the scope to your situation.
Please let us know which data and regulations are involved. We'll define the scope and schedule the assessment.
Data Sovereignty Assessment
With the Data Sovereignty Assessment, you’ll know within one week where your data is located, which jurisdiction it falls under, and who has access to it. SUE evaluates this against the GDPR, NIS2, and DORA and provides a roadmap, ranging from quick wins—such as encryption with your own keys—to decisions about whether to use a European cloud or an on-premises solution.
Data sovereignty
From Assessment to Action: Taking Control of Data Sovereignty
Data sovereignty is a case-by-case consideration for each dataset. For some datasets, hosting them in a European region with a hyperscaler is sufficient. For others, you want to avoid any dependence on a foreign jurisdiction.
European organizations are investing heavily in sovereignty. Gartner expects spending on sovereign cloud IaaS in Europe to rise by 83% in 2026, reaching $12.6 billion. The hyperscalers are also making moves: AWS launched the AWS European Sovereign Cloud in January 2026, with its first region in Germany.
More options don't make the choice any easier. For each data domain, the assessment provides the answer that best fits your risks and regulatory requirements.
Why Conduct a Data Sovereignty Assessment?
Data stored in a European region by a U.S. provider may still be subject to U.S. laws, such as the CLOUD Act. Whether that’s a problem depends on the data, your industry, and your customers. A SaaS provider that serves banks faces different challenges than a manufacturing company that handles design data.
We'll map out where your data is stored, processed, and accessed, and identify your dependencies on cloud providers and vendors. Afterward, you'll know what you need to keep in-house and what you can safely outsource.
01
Scope
We identify the objectives, the regulations that apply to you—such as the GDPR, NIS2, and DORA—and the critical data domains, such as customer data and operational data.
02
Data mapping
We identify where data is stored, processed, and accessed; how it moves between systems and countries; and where exposure to foreign jurisdictions arises.
03
Risk and compliance assessment
We assess compliance with regulations and vulnerabilities—such as vendor lock-in and access from other countries—as well as the security measures in place for your data.
04
Gap Analysis
We compare the current situation with your sovereignty requirements and identify the risks and dependencies associated with cloud providers.
05
Roadmap
You'll receive a phased roadmap: quick wins such as encryption and policy adjustments, and long-term options such as a European cloud, a sovereign cloud offering, or your own infrastructure.
More About Managed InfrastructureWhat you get
- An analysis of data location, compliance gaps, and risks, with recommendations for each data domain.
- A prioritized, phased plan to reduce dependencies and comply with the GDPR, NIS2, and DORA.
To learn how to set up and maintain a secure cloud environment, read the cloud security guide. For more information on what SUE does to enhance your security, visit the Cloud Security page.
Within one week, you will have:
-
Understanding where your data is stored and who has access to it
-
A roadmap with quick wins and long-term decisions
Control Over Critical Infrastructure
SIDN
Strengthening Critical Infrastructure at SIDN
SIDN, the organization behind the .nl domain, faced a double challenge: maintaining...
NXP
NXP reduces virtualization costs and gains strategic flexibility with Apache CloudStack
NXP, a global semiconductor manufacturer, faced rising costs for its prop...
About SUE
Modernize the code. Optimize the cloud. Run the platform.
SUE is a Dutch cloud native solutions partner that modernizes mission-critical applications, reduces cloud costs, and manages your platform. Specialists in Linux, Kubernetes, and the cloud.
29+
Years Experience
150+
Engineers and consultants
1.150+
Certifications
ISO
9001 & 27001
500+
Projects
75+
Research papersFrequently asked questions
All frequently asked questions
A data sovereignty assessment identifies where your data is located, which jurisdiction it falls under, and who has access to it, and evaluates this against regulations such as the GDPR, NIS2, and DORA. SUE conducts the assessment in one week and provides a roadmap with quick wins and long-term options.
Not automatically. The CLOUD Act can require U.S. providers to disclose data, even if it is stored in Europe. Encryption where you control the keys reduces that risk. A sovereign cloud solution or a European provider reduces it even further. The appropriate measure depends on the sensitivity of the data. Have your legal counsel or privacy officer review the legal considerations.
Usually not for everything. A lot of data can remain with a hyperscaler, provided the right region, encryption, and contractual agreements are in place. For the most sensitive data, you should opt for a sovereign cloud offering, a European provider, or your own infrastructure. SUE works with AWS, Azure, and Google Cloud, as well as European alternatives, and provides advice tailored to each data domain.
Although the terms are often used interchangeably, there is an important difference. Data sovereignty is purely about control over your information: you guarantee that your business data is stored and processed exclusively within the EU (and under European legislation such as the GDPR). Digital sovereignty goes a big step further. This means that you have full control and independence over your entire IT infrastructure, software, and cloud environment. You avoid vendor lock-in with foreign Big Tech parties and retain the autonomy (IT independence) to decide for yourself which technology to use. SUE helps organizations become digitally sovereign by building robust, cloud-agnostic platforms based on open-source enterprise technology (such as Linux and SUSE).
Ready for the next step?
Ready for the next step?
Please let us know which data and regulations are involved. We'll define the scope and schedule the assessment.
* required