EU Cloud Sovereignty Assessment

Based on: GDPR (Regulation (EU) 2016/679), Data Governance Act (Regulation (EU) 2022/868)

Select an option…Exclusively within the EU/EEAPrimarily in the EU, with limited non-EU processingMixed EU and non-EU locationsPrimarily or exclusively outside the EUUnknown

Based on: CLOUD Act (Clarifying Lawful Overseas Use of Data Act), FISA (Foreign Intelligence Surveillance Act), Declaration for European Digital Sovereignty (2025)

Select an option…EU-headquartered providerEU subsidiary of a non-EU parentNon-EU provider with EU data centersNon-EU provider without EU data centersUnknown

Based on: NIS2 Directive (Directive (EU) 2022/2555), EU Cybersecurity Act (Regulation (EU) 2019/881)

Select an option…Organization holds all keys (BYOK/HYOK)Shared key management with providerProvider manages all keysNo encryption in place

Based on: GDPR (Regulation (EU) 2016/679), NIS2 Directive (Directive (EU) 2022/2555), DORA (Regulation (EU) 2022/2554)

Select an option…Certified and regularly auditedCompliance measures exist but not auditedPartial compliance — work in progressNo formal compliance program

Based on: GDPR (Regulation (EU) 2016/679) — Chapter V, Data Act (Regulation (EU) 2023/2854)

Select an option…No transfers outside EU/EEATransfers with SCCs and transfer impact assessmentsTransfers with SCCs but no impact assessmentsTransfers without formal safeguardsUnknown

Based on: Artificial Intelligence Act (Regulation (EU) 2024/1689)

Select an option…AI inventory and risk classification completedAwareness exists but no formal classificationNo AI governance measuresNot applicable — no AI systems in use

Based on: eIDAS 2.0 (Regulation (EU) 2024/1183)

Select an option…Already integrated or actively implementingPlanning integration within 12 monthsAware but no concrete plansNot aware of eIDAS 2.0

Based on: NIS2 Directive (Directive (EU) 2022/2555), DORA (Regulation (EU) 2022/2554)

Select an option…Yes — tested incident response with 24h/72h reporting capabilityIncident response plan exists but untestedAd-hoc incident handling, no formal processNo incident response capability

Based on: Data Act (Regulation (EU) 2023/2854), Digital Markets Act (Regulation (EU) 2022/1925)

Select an option…Full portability — standard formats, no lock-inMostly portable with some proprietary dependenciesSignificant vendor lock-inUnknown

Based on: GDPR (Regulation (EU) 2016/679) — Art. 28, NIS2 Directive (Directive (EU) 2022/2555) — Art. 21(2)(d), DORA (Regulation (EU) 2022/2554) — Art. 28-30

Select an option…Full register with regular audits and approval processRegister maintained but no regular auditsLimited visibility into subprocessorsNo subprocessor management