TL;DR<\/h2>\n\n- Max Schrems successfully challenged Safe Harbor and the EU-U.S. Privacy Shield due to U.S. surveillance.<\/li>\n
- Starting in 2025, Microsoft will offer three sovereign cloud models with data remaining in Europe.<\/li>\n
- With Microsoft\u2019s solution, customers retain control over encryption keys via Azure Managed HSM.<\/li>\n
- AWS is establishing a European organization headquartered in Germany for its Sovereign Cloud by end of 2025.<\/li>\n
- Critics doubt that U.S. providers can legally shield themselves from U.S. surveillance laws.<\/li>\n<\/ul>\n
European data protection authorities have long been concerned that U.S. authorities can, if necessary, access data hosted in Europe – and not only that. There have also been documented cases of industrial espionage through these channels.<\/p>\n
Austrian privacy activist and lawyer Max Schrems therefore successfully brought down the transatlantic Safe Harbor agreement before the Court of Justice of the European Union (CJEU) in 2016, and four years later, the EU-U.S. Privacy Shield as well.<\/p>\n
Diametral Sovereignty Concepts<\/h2>\n
American cloud giants AWS and Microsoft have attempted to meet the stricter requirements of the GDPR and other data protection regulations by establishing data centers within the EU. Now, however, they are promising a form of digital sovereignty diametrically opposed to the European understanding – less about reducing dependency on companies like themselves, and more about protecting data itself.<\/p>\n
![\"\"](\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2025\/07\/pexels-rpnickson-3082341-250x167.jpg\")
<\/a><\/p>\nMicrosoft and AWS are developing sovereign cloud solutions for European customers. Image source: Pexels<\/p>\n<\/div>\n
According to IT-Business, a German trade publication, both cloud providers have independently taken steps toward enhanced digital sovereignty aimed at protecting – or even isolating – European data.<\/p>\n
As reported, Microsoft CEO Satya Nadella unveiled a new concept during the AI Tour in Amsterdam<\/a> in mid-June 2025, ensuring that European customer data stored in Microsoft\u2019s cloud solutions remains within Europe. To prevent data from being transferred to the U.S. or elsewhere, European employees will manage operations and access, while customers retain full encrypted control. A central component of this jointly developed solution is Azure Managed HSM Encryption, which allows customers to hold their own encryption keys and generate, manage, and securely store them either independently or through partners.<\/p>\nMicrosoft Sees Encryption as the Key<\/h2>\n
This approach can be integrated with an external key manager, offering the advantage of key generation compliant with the highest FIPS standards. The integrated hardware security module (HSM) can be deployed either as an on-premises appliance or as a service.<\/p>\n
In Amsterdam, Nadella presented three distinct variants<\/strong> of this new concept, all expected to become available by year-end:<\/p>\n\n- A Sovereign or \u201cSovereign Public Cloud\u201d ensuring that customer data remains and is controlled exclusively within Europe, leveraging existing European data centers<\/li>\n
- A \u201cSovereign Private Cloud\u201d hosted in local Microsoft data centers, supporting hybrid cloud deployments on-premises or via partners<\/li>\n
- A \u201cNational Partner Cloud,\u201d specifically tailored for government agencies and operators of critical infrastructure<\/li>\n<\/ul>\n
\u201cNo Blank Check from U.S. Surveillance Laws\u201d<\/h2>\n
Benjamin Schilz, CEO of Berlin-based secure messaging specialist Wire, expressed initial skepticism: \u201cMicrosoft does not have a blank check from U.S. surveillance laws. The promised sovereign private cloud makes commitments that cannot be legally fulfilled. This isn\u2019t about good intentions – it\u2019s a simple fact: every U.S. software provider can be legally compelled to carry out surveillance measures or arbitrarily block access to services.\u201d<\/p>\n
He further noted that Microsoft\u2019s source code is not open, and there are no legal barriers preventing the U.S. government from demanding the insertion of \u201cbackdoors\u201d to extract cryptographic keys, customer data, or metadata.<\/p>\n\n\n”<\/span><\/p>\n\/\/ Key point<\/div>\nThis isn\u2019t about good intentions – it\u2019s a simple fact: every U.S. software provider can be legally compelled to carry out surveillance measures or arbitrarily block access to services.<\/p>\n<\/blockquote>\n<\/figure>\n
AWS Goes One Step Further<\/h2>\n
Is AWS\u2019s data space truly sovereign?<\/a> IT-Business raises this question regarding another U.S. hyperscaler. In Hamburg, Amazon Web Services recently announced new sovereignty controls and a governance structure for its \u201cAWS European Sovereign Cloud,\u201d pledging not to share data with third parties – similar to Microsoft\u2019s approach.<\/p>\nKathrin Reiz, currently Vice President of AWS Industries in Germany, will lead governance efforts and head a dedicated Security Operations Center (SoC). The AWS European Sovereign Cloud – which won\u2019t be available until end of 2025 – will otherwise provide the familiar APIs from the AWS Nitro System.<\/p>\n
For this \u201csovereign offering,\u201d AWS is establishing a European organization comprising a parent company and three subsidiaries based in Germany. In addition to Reiz on the management team, the structure will include EU-based security and data protection officers. An independent four-member advisory board composed of experts from EU member states will serve as an oversight body and report on the AWS European Sovereign Cloud.<\/p>\n
The critical question remains: would AWS defy a U.S. court order demanding access to European data? According to AWS, it has never received a request resulting in the disclosure of corporate or governmental data stored outside the U.S. to the U.S. government – but it cannot guarantee this will never happen.<\/p>\n
Frequently Asked Questions<\/h2>\n\nWhy were Safe Harbor and Privacy Shield invalidated?<\/strong><\/summary>\nBecause U.S. authorities could access data stored in Europe. Max Schrems highlighted violations of fundamental data protection rights.<\/p>\n<\/details>\n\nWhat does Microsoft promise with its sovereign cloud?<\/strong><\/summary>\nEuropean customer data stays in Europe. Access is controlled by European staff, and customers retain ownership of encryption keys.<\/p>\n<\/details>\n\nHow does encryption work in Microsoft\u2019s sovereign cloud?<\/strong><\/summary>\nVia Azure Managed HSM, customers can generate, manage, and store their own keys – the key never leaves their control.<\/p>\n<\/details>\n\nWhat is AWS doing to enhance digital sovereignty?<\/strong><\/summary>\nAWS is creating a European organization headquartered in the EU, with dedicated EU-based security and data protection officers and a Security Operations Center in Germany.<\/p>\n<\/details>\n\nWhy is the sovereignty of U.S. cloud providers criticized?<\/strong><\/summary>\nU.S. providers can be legally required to conduct surveillance. There are no legal safeguards against backdoors or forced data access.<\/p>\n<\/details>\n
Editor\u2019s Reading Recommendations<\/h2>\n\n- API-First: Why modern cloud architectures live or die by API design<\/a><\/li>\n
- Pretext: Does a JavaScript library solve a 30-year browser problem – or is it just hype?<\/a><\/li>\n
- AWS vs. Azure vs. Google Cloud 2026: An honest comparison for DACH enterprises<\/a><\/li>\n<\/ul>\n
More from the MBF Media Network<\/h2>\n
SecurityToday<\/a> | MyBusinessFuture<\/a> | Digital Chiefs<\/a><\/p>\n
European data protection authorities have long been concerned that U.S. authorities can, if necessary, access data hosted in Europe – and not only that. There have also been documented cases of industrial espionage through these channels.<\/p>\n
Austrian privacy activist and lawyer Max Schrems therefore successfully brought down the transatlantic Safe Harbor agreement before the Court of Justice of the European Union (CJEU) in 2016, and four years later, the EU-U.S. Privacy Shield as well.<\/p>\n
Diametral Sovereignty Concepts<\/h2>\n
American cloud giants AWS and Microsoft have attempted to meet the stricter requirements of the GDPR and other data protection regulations by establishing data centers within the EU. Now, however, they are promising a form of digital sovereignty diametrically opposed to the European understanding – less about reducing dependency on companies like themselves, and more about protecting data itself.<\/p>\n
![\"\"](\"https:\/\/www.cloudmagazin.com\/en\/wp-content\/uploads\/2025\/07\/pexels-rpnickson-3082341-scaled.jpg\")
<\/a><\/p>\nMicrosoft and AWS are developing sovereign cloud solutions for European customers. Image source: Pexels<\/p>\n<\/div>\n
According to IT-Business, a German trade publication, both cloud providers have independently taken steps toward enhanced digital sovereignty aimed at protecting – or even isolating – European data.<\/p>\n
As reported, Microsoft CEO Satya Nadella unveiled a new concept during the AI Tour in Amsterdam<\/a> in mid-June 2025, ensuring that European customer data stored in Microsoft\u2019s cloud solutions remains within Europe. To prevent data from being transferred to the U.S. or elsewhere, European employees will manage operations and access, while customers retain full encrypted control. A central component of this jointly developed solution is Azure Managed HSM Encryption, which allows customers to hold their own encryption keys and generate, manage, and securely store them either independently or through partners.<\/p>\n This approach can be integrated with an external key manager, offering the advantage of key generation compliant with the highest FIPS standards. The integrated hardware security module (HSM) can be deployed either as an on-premises appliance or as a service.<\/p>\n In Amsterdam, Nadella presented three distinct variants<\/strong> of this new concept, all expected to become available by year-end:<\/p>\n Benjamin Schilz, CEO of Berlin-based secure messaging specialist Wire, expressed initial skepticism: \u201cMicrosoft does not have a blank check from U.S. surveillance laws. The promised sovereign private cloud makes commitments that cannot be legally fulfilled. This isn\u2019t about good intentions – it\u2019s a simple fact: every U.S. software provider can be legally compelled to carry out surveillance measures or arbitrarily block access to services.\u201d<\/p>\n He further noted that Microsoft\u2019s source code is not open, and there are no legal barriers preventing the U.S. government from demanding the insertion of \u201cbackdoors\u201d to extract cryptographic keys, customer data, or metadata.<\/p>\n \n”<\/span><\/p>\n This isn\u2019t about good intentions – it\u2019s a simple fact: every U.S. software provider can be legally compelled to carry out surveillance measures or arbitrarily block access to services.<\/p>\n<\/blockquote>\n<\/figure>\n Is AWS\u2019s data space truly sovereign?<\/a> IT-Business raises this question regarding another U.S. hyperscaler. In Hamburg, Amazon Web Services recently announced new sovereignty controls and a governance structure for its \u201cAWS European Sovereign Cloud,\u201d pledging not to share data with third parties – similar to Microsoft\u2019s approach.<\/p>\n Kathrin Reiz, currently Vice President of AWS Industries in Germany, will lead governance efforts and head a dedicated Security Operations Center (SoC). The AWS European Sovereign Cloud – which won\u2019t be available until end of 2025 – will otherwise provide the familiar APIs from the AWS Nitro System.<\/p>\n For this \u201csovereign offering,\u201d AWS is establishing a European organization comprising a parent company and three subsidiaries based in Germany. In addition to Reiz on the management team, the structure will include EU-based security and data protection officers. An independent four-member advisory board composed of experts from EU member states will serve as an oversight body and report on the AWS European Sovereign Cloud.<\/p>\n The critical question remains: would AWS defy a U.S. court order demanding access to European data? According to AWS, it has never received a request resulting in the disclosure of corporate or governmental data stored outside the U.S. to the U.S. government – but it cannot guarantee this will never happen.<\/p>\n Because U.S. authorities could access data stored in Europe. Max Schrems highlighted violations of fundamental data protection rights.<\/p>\n<\/details>\n European customer data stays in Europe. Access is controlled by European staff, and customers retain ownership of encryption keys.<\/p>\n<\/details>\n Via Azure Managed HSM, customers can generate, manage, and store their own keys – the key never leaves their control.<\/p>\n<\/details>\n AWS is creating a European organization headquartered in the EU, with dedicated EU-based security and data protection officers and a Security Operations Center in Germany.<\/p>\n<\/details>\n U.S. providers can be legally required to conduct surveillance. There are no legal safeguards against backdoors or forced data access.<\/p>\n<\/details>\n SecurityToday<\/a> | MyBusinessFuture<\/a> | Digital Chiefs<\/a><\/p>\nMicrosoft Sees Encryption as the Key<\/h2>\n
\n
\u201cNo Blank Check from U.S. Surveillance Laws\u201d<\/h2>\n
AWS Goes One Step Further<\/h2>\n
Frequently Asked Questions<\/h2>\n
Why were Safe Harbor and Privacy Shield invalidated?<\/strong><\/summary>\n
What does Microsoft promise with its sovereign cloud?<\/strong><\/summary>\n
How does encryption work in Microsoft\u2019s sovereign cloud?<\/strong><\/summary>\n
What is AWS doing to enhance digital sovereignty?<\/strong><\/summary>\n
Why is the sovereignty of U.S. cloud providers criticized?<\/strong><\/summary>\n
Editor\u2019s Reading Recommendations<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n