Record amounts are being invested in data centers worldwide. Good news for digital infrastructure, but not necessarily for data control. Indeed, hosting data within a country does not guarantee its sovereignty if the organization operating it is foreign. A distinction still too rarely understood.
A global infrastructure race
Hyperscalers are expected to spend close to three trillion dollars on data centers by 2030, with American providers leading the way. This build-out is now truly global: Microsoft alone announced 17.5 billion dollars of AI and cloud investment across India between 2026 and 2029, while similar projects multiply in the Middle East, Southeast Asia and Europe.
These facilities are often presented as a guarantee of sovereignty. This presentation rests on a widespread assumption: if data remains physically within a country, it would be protected and subject to that country's law. Yet the location of a server does not determine who can legally access the data it holds.
Cloud Act: when hosting your data locally no longer means controlling it
Access to data is determined not by where it is stored, but by the law to which the actors that hold or control it are subject to. The Cloud Act is the most direct illustration of this. Passed in the United States in 2018, it allows American authorities to require any company subject to US law to hand over the data it holds or controls, wherever that data is stored in the world.
Every actor is concerned: from the hosting provider, which stores the data, to the vendor, which operates the software solution processing it. As soon as either falls under US law, it can be compelled to hand over the data, regardless of its location. Hosting data in a given country with an American provider such as Amazon Web Services therefore offers no protection from the Cloud Act. Conversely, choosing a European host is not enough either if the vendor of the solution is American.
This reach is not theoretical. On June 10th 2025, during a hearing before the French Senate, the director of public and legal affairs at Microsoft France acknowledged that he could not guarantee that the data of French citizens would never be transferred to US authorities. Because Microsoft is a global provider, the admission resonated far beyond France: it applies to every organization relying on an American vendor, anywhere in the world.
So-called sovereign offerings from major American providers do not resolve this underlying conflict. As long as the entity operating the service falls under US law, it remains bound to respond to an injunction, regardless of the commercial guarantees advertised.
Data sovereignty has become a global concern
Control over data has become a worldwide issue. More than 140 countries have adopted some form of data protection legislation, and dozens of them now require that certain categories of data remain within their national borders. India with its DPDP Act, the United Arab Emirates and Saudi Arabia for sensitive sectors such as banking and healthcare, and China with the PIPL have all tightened their rules.
This shift is reflected in how organizations now evaluate their providers. In a global survey of 3,700 executives across 21 countries, 86 percent said the country of origin and regulatory alignment of their cloud provider had become decisive criteria. A 2026 study of 2,100 leaders across eight countries similarly found that data sovereignty has moved from a compliance topic to a board-level concern.
In every case, the logic is the same: leaving the data of one's citizens or organization under a foreign jurisdiction is seen as a loss of control. Wherever a company operates, the question of who holds legal authority over its data now arises in the same way.
Sovereignty applies to mobile data too
The debate often centers on cloud and infrastructure, but it applies just as much to mobile endpoints. Smartphones and tablets constantly process sensitive corporate data, and the security solutions deployed to protect them analyse that data continuously. The question is the same as for any cloud service: if the vendor is subject to a foreign jurisdiction, so is the data it processes. Choosing the vendor of a mobile security solution is, in this respect, a sovereignty decision in its own right.
Keep control of your data with a sovereign vendor
The only lasting guarantee lies in choosing an actor that controls its data end to end, not subject to any extraterritorial jurisdiction. This is Pradeo's position: only European vendor recognised as a global leader in mobile security. As a European vendor hosting its data with a French provider qualified SecNumCloud, Pradeo controls both the software and the hosting of its solutions: both links sit beyond the reach of the Cloud Act and comparable laws.
Protecting mobile data is not limited to detecting threats. It also means keeping control over the data that protection generates. Hosting within a country is a first step, but true sovereignty is measured by the identity of the organization that controls the data, from its software to its hosting.
