Digital sovereignty: three questions for your suppliers

In the board meeting, the term digital sovereignty comes up. Everyone nods. Afterwards, someone asks over coffee what it actually means for your organisation. Nobody knows exactly.

That is not strange. The term is used a lot and explained little. At its core, it is about control: do you decide what happens to your data and systems, or does someone else decide that? You can reduce it to three questions that you ask every supplier. What that means for a cloud service, you can read on our page about sovereign cloud.

Question 1: where is our data?

This is the easiest question, and yet the answer often stays vague. 'In Europe' is a start. Ask further: which country, which data centre, and where are the backups? Backups are often forgotten, while they are a complete copy.

Also ask about the sub-processors. A supplier can itself be based in the Netherlands and still use an American service for mail, storage or AI. A good supplier keeps a public list of them. Ask for the answer on paper: a data location statement or a list of sub-processors says more than a sales conversation.

Question 2: who can access it, and under which law?

A server in Amsterdam is no guarantee. The US CLOUD Act from 2018 gives US authorities access to data at American companies, even if that data is stored in Europe. Sometimes the company is not even allowed to tell you that there has been a request.

Microsoft, Google and Amazon themselves publish transparency reports on the government requests they receive. Read one some time; it is instructive. So the question is also which law the supplier itself falls under, and the parties it engages.

Question 3: can we leave if we have to?

Sovereignty is also the freedom to leave. If your data is locked in a closed format, or your work processes only run in one ecosystem, then switching is expensive. That dependence is a risk, even if nothing ever goes wrong.

So ask: in which formats can I export my data, how long does that take and what does it cost? Put it in the contract, not in an email.

Why this belongs on the agenda now

Since 15 August 2026, the Cybersecurity Act has applied in the Netherlands, the Dutch implementation of the European NIS2 Directive (rijksoverheid.nl, 15 August 2026). Organisations that fall under it must manage the risks in their supply chain. Your suppliers are part of that, and the board is responsible. The directive names fines of up to 10 million euros or 2 percent of worldwide annual turnover for essential entities (Directive (EU) 2022/2555, Article 34).

Trade conflicts and political choices elsewhere can affect services that you rely on every day. You do not need to be afraid of that. It is wise, though, to know where you are dependent.

What you can do this month

1. Make a list of the five services your organisation relies on most, such as mail, documents, accounting, customer data and communication.
2. For each service, ask the three questions above and write down the answers.
3. Mark where sensitive data is outside the EU or under foreign law. Those are your priorities.
4. Include the questions in your purchasing terms, so that every new supplier gets them.
5. Put the topic on the board agenda twice a year.

How Noveu answers the three questions

Noveu is a Dutch company. Your data and backups are stored in a Hetzner data centre in Falkenstein, Germany. Cloudflare (US) sits at the edge of the network. You use mail, files and documents, Messages (beta) and Noveu Meet via a link (beta). You can find the guides in the help. If you want to hold a supplier up against those three questions, use the seven questions for choosing a sovereign workplace.