Digital Sovereignty and Schrems II: What European Businesses Need to Know in 2026

Six years after the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield in Schrems II, the question of where European data lives — and who can legally reach into it — has become the single most important compliance topic for any business operating in the EU.

The landscape in 2026 is more complex, not simpler. The Trans-Atlantic Data Privacy Framework (TADPF) adopted in 2023 is already facing its next legal challenge. FISA Section 702 was reauthorised in April 2024 with expanded surveillance powers. The US CLOUD Act continues to apply extraterritorially to every subsidiary of a US corporation, regardless of where the servers are located. Meanwhile, the draft EU Cloud Certification Scheme (EUCS) is still fighting over what "sovereign" even means.

If you're a European business, a Data Protection Officer, a CTO, or a legal counsel trying to make infrastructure decisions, this guide is for you. We'll cover what digital sovereignty actually means in practice, what Schrems II requires you to do (not just think about), which providers are genuinely EU-sovereign, and how to build a Schrems II-safe architecture in 2026.

What Is Digital Sovereignty?

Digital sovereignty is the principle that a jurisdiction — typically a nation state or a union of states like the EU — retains meaningful legal, operational, and technical control over the data, infrastructure, and software its citizens, businesses, and public bodies rely on.

It breaks down into three interlocking layers:

1. Data sovereignty — personal and business data is stored, processed, and accessed exclusively under the jurisdiction's laws. No foreign authority can compel disclosure without going through EU legal channels (like Mutual Legal Assistance Treaties).
2. Operational sovereignty — the people who operate the infrastructure, the entity that owns it, and the supply chain behind it are all subject to EU jurisdiction. A US parent company with an EU subsidiary does not qualify.
3. Technical sovereignty — the software, hardware, and cryptographic keys are controllable by the customer or an EU-sovereign entity, and there are no hidden channels (telemetry, forced updates, key-escrow arrangements) that could expose data to foreign entities.

This is the bar the European Commission, the European Data Protection Board (EDPB), and national supervisory authorities have been slowly converging on. It's also the bar that almost no US-owned cloud — no matter how many "EU region" stickers it wears — can meet.

Schrems II: The Decision That Changed Everything

On 16 July 2020, the Court of Justice of the European Union delivered judgment in Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18), commonly known as Schrems II.

The Background

Austrian privacy lawyer Max Schrems, founder of the non-profit NOYB — European Center for Digital Rights, brought a complaint against Facebook Ireland's transfer of EU user data to the United States. He argued that US surveillance laws — chiefly FISA Section 702 and Executive Order 12333 — did not provide EU citizens with the "essentially equivalent" level of protection that EU law requires for international data transfers.

What the CJEU Decided

• The EU-US Privacy Shield was invalidated with immediate effect. Thousands of transatlantic data transfers became unlawful overnight.
• Standard Contractual Clauses (SCCs) were upheld in principle, but the Court imposed a critical new condition: data exporters must conduct a case-by-case assessment of whether the destination country's laws provide essentially equivalent protection. If not, SCCs alone are insufficient and supplementary measures must be added.
• US surveillance law was found incompatible with EU fundamental rights. FISA 702 allows bulk collection of non-US persons' data without the kind of judicial oversight required under Article 8 of the EU Charter.

The practical consequence: every EU business transferring personal data to the US must now document why, under what legal basis, and with what additional technical protections. Most do not do this. Most are technically non-compliant.

The Trans-Atlantic Data Privacy Framework (TADPF) — Shaky From Day One

In July 2023, the European Commission adopted an adequacy decision for the Trans-Atlantic Data Privacy Framework, the successor to Privacy Shield. President Biden's Executive Order 14086 introduced a new Data Protection Review Court and purported to limit bulk collection to "necessary and proportionate" purposes.

On paper, this restored a lawful route for EU-US transfers for certified US organisations. In practice, almost every serious EU legal scholar — and Max Schrems himself — expects Schrems III to strike it down. Here's why:

• The Data Protection Review Court is an executive-branch body, not an independent judicial tribunal in the sense EU law requires. Its decisions are classified and cannot be appealed to a real court.
• FISA 702 was reauthorised in April 2024 (the Reforming Intelligence and Securing America Act) and the "necessary and proportionate" limits are interpreted internally by US agencies, not by independent oversight.
• Executive Orders can be revoked by any future US President with a stroke of a pen. An incoming administration could dissolve EO 14086 overnight. Regulatory certainty requires statutes, not executive action.
• NOYB has already filed challenges. Legal observers expect a preliminary reference to the CJEU within 24-36 months of the framework's adoption.

Planning advice: do not architect critical data flows on the assumption that TADPF will survive. Build for Schrems III.

US Surveillance Law: FISA 702, Section 702, and Executive Order 12333

To understand why US-owned clouds are structurally incompatible with EU digital sovereignty, you have to understand what US surveillance law actually permits.

FISA Section 702

Authorises the US government to compel "electronic communication service providers" — a category that explicitly includes cloud providers, email services, and telecommunications carriers — to hand over communications and stored data of non-US persons located outside the US. Key features:

• No probable cause requirement for non-US targets
• Bulk collection permitted through "upstream" and PRISM programmes
• Gag orders prevent the provider from telling the data subject or the data controller
• Reauthorised in April 2024 for two more years, with expanded definitions of "electronic communication service provider"

Executive Order 12333

Authorises the NSA to conduct signals intelligence outside US borders. Unlike FISA 702 it does not even require a FISA court order. It is the legal basis for bulk interception of fibre-optic cables, cable-landing stations, and satellite traffic — including traffic to and from EU data centres owned by US parent companies.

The CLOUD Act

The Clarifying Lawful Overseas Use of Data Act (2018) amended the Stored Communications Act to confirm that US providers must comply with lawful US government requests for data regardless of where the data is physically stored. This applies to every subsidiary, branch, and affiliate of a US company, worldwide. Frankfurt, Dublin, Amsterdam — it doesn't matter. If the parent is subject to US jurisdiction, the data is reachable.

For a deeper look at the CLOUD Act specifically, see our sibling article The US CLOUD Act and EU Data: A Complete 2026 Guide.

"GDPR-Compliant" Is Not the Same as Schrems II-Safe

This is the single most common compliance mistake we see. A US hyperscaler will happily sign a Data Processing Agreement (DPA), attach Standard Contractual Clauses, tick the "EU region" box in your console, and tell you you're "GDPR-compliant."

None of that addresses Schrems II. GDPR Article 28 (processor obligations) and Article 32 (security of processing) are necessary but not sufficient. Schrems II is about Article 44-49 (international transfers) — a distinct chapter of GDPR that most vendors quietly ignore.

A truthful compliance posture for a US cloud requires all of the following:

• A signed DPA and the latest 2021 SCCs (Module 2 or Module 3)
• A documented Transfer Impact Assessment (TIA) demonstrating that US law does not undermine the SCCs in your specific use case
• Supplementary measures, per EDPB Recommendations 01/2020, sufficient to render the data unintelligible to US authorities
• A DPIA under GDPR Article 35 if processing is high risk
• Evidence you considered EU-sovereign alternatives and documented why you chose otherwise

If your compliance file doesn't contain all of these, your US cloud usage is exposed.

EDPB Recommendations 01/2020: Supplementary Measures

On 18 June 2021, the European Data Protection Board adopted its final Recommendations 01/2020 on supplementary measures. This is the operative guidance most DPOs haven't read carefully enough.

The EDPB classifies supplementary measures into three categories:

1. Technical measures — encryption, pseudonymisation, split processing. The EDPB states clearly: only technical measures can be effective against Section 702 / EO 12333 surveillance.
2. Contractual measures — transparency obligations, obligation to challenge requests, warrant canaries. On their own, not sufficient against government access powers.
3. Organisational measures — internal policies, staff training, data minimisation. Again, insufficient on their own.

The "Effective Encryption" Bar

The EDPB specifies that encryption counts as an effective supplementary measure only if:

• Encryption keys are exclusively under the control of the data exporter or a trusted EU entity
• Keys are never accessible to the importer (the US cloud)
• The algorithm is strong and the implementation is state-of-the-art
• Data in use (in memory, during processing) is also protected — this is where most setups fail, because you can't usefully process ciphertext

This is why AWS KMS, Azure Key Vault, and Google Cloud KMS — where the provider manages the keys or the key-management infrastructure — do not meet the EDPB bar for transfers to the US. You need an EU-sovereign KMS (like HashiCorp Vault in an EU-sovereign cloud, or a dedicated HSM) holding keys the US cloud cannot reach.

SCCs Are Not a Magic Bullet

We still see compliance programmes that treat the 2021 Standard Contractual Clauses as if they automatically legalise any transfer. They do not.

The 2021 SCCs (Commission Implementing Decision (EU) 2021/914) require the data exporter to:

• Conduct a Transfer Impact Assessment documenting the laws of the third country
• Document that the SCCs, in combination with supplementary measures, provide essentially equivalent protection
• Suspend transfers if the importer is unable to comply
• Notify supervisory authorities of any government access request

The Irish Data Protection Commission's May 2023 decision against Meta (fine of €1.2 billion) explicitly confirmed that SCCs without adequate supplementary measures do not cure a US transfer. That was the single largest GDPR fine in history at the time, and the reasoning applies to every US cloud user.

Industry-Specific Sovereignty Requirements

Beyond the horizontal GDPR regime, several EU member states have stricter sectoral requirements for regulated industries. If you operate in these sectors, EU-region US clouds are often explicitly non-compliant.

SecNumCloud is the most consequential. France's Cloud de Confiance doctrine means that for sensitive public sector workloads, only SecNumCloud-qualified providers (OVHcloud, Outscale, and more recently Bleu — a Capgemini/Orange/Microsoft JV still awaiting final qualification) are eligible. AWS EU, Azure EU, and Google Cloud EU are all excluded at the top tier.

What "Sovereign Cloud" Actually Requires

Vendors will slap the word "sovereign" on any product. Here's the honest rubric that distinguishes real EU sovereignty from marketing:

1. Ownership — the operating entity is headquartered in an EU/EEA state, with EU beneficial owners. No US, UK-post-Brexit, or third-country parent.
2. Jurisdiction over all data access paths — the company answers only to EU courts for data-access requests. No cross-border warrants, no CLOUD Act obligations.
3. No reachback by non-EU authorities — there is no subsidiary, staff, or corporate affiliate that US, Chinese, or other foreign authorities can compel.
4. EU-controlled infrastructure — servers, networks, and cryptographic keys are physically and logically controlled by the EU entity. No shared control planes with non-EU clouds.
5. EU-controlled staff — administrators with privileged access are EU residents subject to EU employment law, with security-vetted backgrounds where applicable.
6. EU-controlled supply chain — hardware, software, and operational dependencies don't create backdoors. (This is the hardest bar; silicon is a global market.)
7. Transparency and auditability — the provider publishes detailed technical and legal documentation enabling customers to conduct their own TIAs and DPIAs.

The EUCS Debate: What Is the EU Cloud Certification Scheme?

The European Cybersecurity Certification Scheme for Cloud Services (EUCS) was mandated by the 2019 Cybersecurity Act and is being developed by ENISA (the EU Agency for Cybersecurity). It's meant to provide a unified, pan-EU certification for cloud services, replacing the patchwork of national schemes.

The draft has gone through multiple rounds and the central fight is about whether the highest assurance level ("High+") should include sovereignty requirements — specifically, EU ownership and immunity from non-EU law.

As of late 2025 / early 2026, the political compromise looks like:

• Sovereignty requirements at the top tier are preserved but optional at national discretion
• Member states can impose stricter national add-ons (so France's SecNumCloud can continue to require EU ownership)
• US-owned clouds can achieve "High" certification but not the sovereignty-specific top tier

The final adopted scheme will shape EU public procurement for the rest of the decade. Watch this space.

Who Are the Genuinely EU-Sovereign Providers?

Setting the "sovereign cloud" marketing aside, here are the providers that actually meet the ownership and jurisdiction tests in 2026:

US Hyperscaler vs EU-Sovereign: The Honest Comparison

A Word on "Microsoft Sovereign Cloud" and Oracle EU Sovereign Cloud

The US hyperscalers have noticed the regulatory trend and are shipping "sovereign" offerings. Be skeptical:

• Microsoft Cloud for Sovereignty / EU Data Boundary — Microsoft still ultimately operates the stack. The software licensing, telemetry, and support staff include US entities. The EDPB has not blessed these as equivalent to EU-sovereign alternatives.
• Bleu (Capgemini / Orange / Microsoft JV in France) — promising structure, but the underlying software stack is licensed from Microsoft and questions about patch channels and telemetry remain. SecNumCloud qualification was still pending in late 2025.
• AWS European Sovereign Cloud — announced for Brandenburg, Germany. Operated by a new AWS EU legal entity with EU-only staff. Interesting, but still a subsidiary of Amazon.com Inc. — and the CLOUD Act follows the parent.
• Oracle EU Sovereign Cloud — Oracle-owned, Oracle-operated. Similar parent-subsidiary issue.

The structural problem is the same in every case: as long as a US parent exists somewhere in the corporate chart, a US court can issue a CLOUD Act order directed at the parent. The parent is then legally obliged to cause its EU subsidiary to comply. "Operated by an EU entity" is not the same as "immune from US legal reach."

A Schrems II-Safe Architecture Checklist

Pragmatic architecture principles for EU data controllers in 2026:

1. Classify data first. Build a data map. Tag each dataset by sensitivity, legal basis, and sovereignty requirement. Personal data, health data, financial data, and anything falling under NIS2/DORA gets the strictest treatment.
2. Default to EU-sovereign for personal data. If a dataset contains identifiable EU personal data and there's no compelling reason to use a US cloud, use an EU-sovereign provider. This alone eliminates 80% of Schrems II risk.
3. Separate control plane and data plane. Even if you use a US cloud for compute, keep the control plane (identity, keys, logs, backups) on EU-sovereign infrastructure.
4. EU-sovereign KMS. Encryption keys must be in a KMS the US cloud cannot access. HashiCorp Vault running in an EU-sovereign cloud, or a hardware HSM under EU control, are the baseline.
5. Zero-trust ingress and egress. Every data flow crossing a trust boundary (EU to US, sovereign to non-sovereign) requires encryption, authentication, and logging.
6. Application-level end-to-end encryption where possible. For highest-sensitivity workloads, encrypt client-side before the data ever reaches the cloud. Providers can't hand over what they can't read.
7. Document your Transfer Impact Assessment. Every transfer of personal data outside the EU — even within SCCs — needs a documented TIA. Keep it current.
8. Plan your exit. DORA and NIS2 both require documented exit strategies for critical ICT providers. If you're on AWS today, have a documented plan to migrate within 12-24 months if TADPF falls.
9. Audit logs in EU-sovereign storage. Audit and access logs are themselves personal data. Store them on EU-sovereign infrastructure.
10. Document everything. Under GDPR accountability (Article 5(2)), the burden is on you to demonstrate compliance. Data Processing Register, DPIAs, TIAs, supplementary measures catalogue.

Your Action Plan: What To Do This Quarter

Step 1 — Data Map

Catalogue every system that handles EU personal data. For each one: where is it hosted, who is the processor, what's the legal basis, is there an SCC, is there a TIA?

Step 2 — Transfer Impact Assessments

For every non-EU transfer, produce a documented TIA. Template elements:

• Categories of data and data subjects
• Purpose and legal basis
• Importer country laws (FISA 702, CLOUD Act, EO 12333 etc. for US)
• Contractual protections (DPA, SCCs)
• Technical supplementary measures (encryption, pseudonymisation, access controls)
• Organisational measures
• Residual risk and conclusion

Step 3 — Eliminate Unnecessary Transfers

Most EU businesses can eliminate 60-80% of their US cloud dependency by moving:

• VPS / VMs to EU-sovereign VPS (DanubeData VPS from €4.49/month, Hetzner Cloud, OVH)
• Databases to EU-sovereign managed DB (DanubeData Managed PostgreSQL/MySQL/MariaDB from €19.99/month)
• Redis/cache to EU-sovereign managed cache (DanubeData Redis/Valkey/Dragonfly from €4.99/month)
• Object storage (S3) to EU-sovereign S3-compatible storage (DanubeData Object Storage from €3.99/month, Scaleway Object Storage, OVH Object Storage)
• Serverless workloads to EU-sovereign serverless (DanubeData Serverless from €5/month, Scaleway Serverless)

Step 4 — KMS and Encryption Uplift

Move encryption keys to an EU-sovereign KMS. If you're using AWS KMS today, migrate keys to an EU-sovereign Vault or HSM.

Step 5 — Documentation and Governance

Update your Article 30 records, DPIAs, sub-processor lists, and privacy notices. File any DPO consultations.

Step 6 — Exit Strategies

For workloads that must stay on US hyperscalers, document a time-bound migration plan to an EU-sovereign alternative. DORA and NIS2 require this anyway; treat it as a contingency that can be activated within 90 days of the next adequacy-decision shock.

Frequently Asked Questions

Is AWS EU region Schrems II-safe?

No. Hosting in Frankfurt or Dublin does not cure the structural issue: Amazon Web Services Inc. (Delaware) remains the ultimate controller of AWS Europe, and the CLOUD Act applies. You can make AWS usage more defensible with supplementary measures (customer-managed keys outside AWS, client-side encryption), but "AWS EU" is not the same as EU-sovereign.

Is Microsoft Sovereign Cloud Schrems II-safe?

Depends on the specific offering. "EU Data Boundary" is not sovereignty — it's a data-residency commitment with ongoing US reachback. The Bleu JV in France comes closer structurally but was still unqualified for SecNumCloud in late 2025 and depends on licensed Microsoft software with open questions about support channels and telemetry.

Are SCCs alone enough?

Rarely. After Schrems II, SCCs must be combined with a documented TIA and supplementary measures. For transfers to the US, the EDPB has indicated that encryption with EU-controlled keys is effectively the only technical measure that survives Section 702 scrutiny.

What about GitHub, Office 365, and Bloomberg Terminal?

All three are US-operated services and fall under FISA 702 and the CLOUD Act. For GitHub, consider EU-sovereign Git hosting (Codeberg, self-hosted GitLab or Gitea on DanubeData VPS or OVH). For Office 365, the EU is working on "Cloud for Sovereignty" variants but the baseline product is not sovereign. Bloomberg Terminal is a specialised case where regulated-finance exemptions often apply, but data flowing through it is still subject to US surveillance; financial services customers typically address this via DORA-compliant third-party risk frameworks rather than eliminating the service.

What certifications should I look for in a sovereign provider?

Ranked by rigour for EU sovereignty:

• SecNumCloud (France) — strictest; requires EU ownership and immunity from foreign law.
• BSI C5 Type 2 (Germany) — continuous-operation attestation.
• ACN Qualificazione QC3/QC4 (Italy) — top-tier Italian public sector.
• ISO 27001, 27017, 27018 — baseline; necessary but not sufficient.
• EUCS High+ (forthcoming) — watch for adoption.

What about CDNs? Cloudflare is US-owned.

Correct, and Cloudflare is a common blind spot. Cloudflare Inc. is subject to the CLOUD Act. For sovereignty-critical sites, use EU-sovereign CDNs (OVH CDN, Gcore-backed EU-only configurations) or self-host caching on EU-sovereign infrastructure.

If TADPF survives, do I still need to migrate?

Yes, for two reasons. First, TADPF is an adequacy decision that can be reversed at any time — historically the CJEU has struck two in a row within a decade. Second, adequacy only addresses the transfer question, not the operational-sovereignty question, and not the sectoral requirements (SecNumCloud, DORA exit plans). The durable answer is EU-sovereign infrastructure for EU personal data.

My business uses Google Analytics. Is that Schrems II-compliant?

Multiple EU supervisory authorities (Austria, France, Italy, Denmark) have ruled that standard Google Analytics usage breaches GDPR because of transfers to the US under Schrems II. Use EU-sovereign alternatives (Plausible, Matomo, Umami) self-hosted on an EU VPS. See our Self-Host Plausible Analytics on VPS guide for setup.

Conclusion: Sovereignty Is a Default, Not a Premium

The story of the last decade is that every new adequacy framework — Safe Harbor, Privacy Shield, TADPF — has been or is likely to be invalidated. The underlying problem is structural: US surveillance law is fundamentally incompatible with EU fundamental rights, and contractual patches can't bridge that gap.

The good news: EU-sovereign alternatives exist today, they're cheaper than the US hyperscalers for most workloads, and they eliminate an entire compliance category. For the typical EU SMB or mid-market company, moving personal-data workloads from AWS to an EU-sovereign stack is both the compliance answer and the cost-optimisation answer.

At DanubeData we built precisely this: a fully managed European platform, EU entity, EU jurisdiction, EU staff, EU-controlled keys, running on dedicated Hetzner bare-metal in Falkenstein, Germany. No US parent. No US subsidiary. No US staff with production access. No reseller of any US cloud. VPS from €4.49, managed databases from €19.99, managed caches from €4.99, S3-compatible object storage from €3.99, serverless from €5, 20TB of traffic included, €50 signup credit.

If you're running a Schrems II audit and your TIA is coming back red, or if your next board meeting has "cloud sovereignty" on the agenda, the cheapest and simplest step is to move your personal-data workloads to an EU-sovereign stack today.

👉 Start with €50 in free credit

Further Reading

• Schrems II judgment (CJEU C-311/18)
• EDPB Recommendations 01/2020 on supplementary measures
• 2021 Standard Contractual Clauses (Commission Implementing Decision 2021/914)
• NOYB — Max Schrems' European Center for Digital Rights
• ANSSI SecNumCloud framework
• BSI Cloud Computing Compliance Criteria Catalogue (C5)
• Our European Cloud Providers comparison
• Our GDPR-Compliant Database Hosting guide

Questions about Transfer Impact Assessments, EU-sovereign architecture, or migrating off US hyperscalers? Contact our team — we've helped dozens of EU businesses complete the migration.