August 27, 2026
GDPR-Compliant vs. Data Sovereign: What Really Matters When Choosing Your Tools
6 min.
European server locations are only half the story
Server location Europe is in almost every pitch deck these days. That sounds reassuring, but it only answers one of two questions: A provider can dutifully run its servers in Frankfurt and still be subject to the laws of its home country. Data residency describes the countries and regions where data is stored and processed. Data sovereignty describes which laws govern this data. Both only align if the cloud provider, its parent company, and all involved service providers are subject to European law.
What often happens in practice: An application is advertised as "hosted in Germany," yet it runs on a US hyperscaler, monitoring is handled by an overseas provider, support is accessed from a third country, and the new AI feature calls a model outside the EU. The storage matches. Yet, control does not lie entirely within Europe.
This is not a matter of waving flags, but a question of control: Can you clearly state where your data resides and which jurisdiction it is legally subject to? In discussions with HR and IT, data sovereignty is coming up more and more frequently, triggered by works councils, proof of compliance for customers, or stricter compliance regulations. This article shows why being GDPR-compliant and data-sovereign are not the same thing, what role the CLOUD Act plays, and what you should look out for when selecting cloud solutions. Especially when sensitive personal data from desk sharing is involved.
GDPR-Compliant vs. Data Sovereign: Two Questions, Two Answers
Both terms are often used interchangeably in sales. However, they actually answer very different questions.
GDPR-Compliant | Data Sovereign | |
|---|---|---|
Key Question | Are the data handled in compliance with regulations? | Who can actually gain access in case of doubt? |
Basis | GDPR, BDSG, Data Processing Agreement (DPA) according to Art. 28 | Provider's headquarters and corporate structure, applicable laws, subprocessors |
Typical Proof | DPA, record of processing activities, TOMs, deletion concept, transparency towards data subjects | List of all subprocessors, operating model, key management, support access paths |
Blind Spot | Does not indicate whether foreign authorities can demand disclosure | Does not indicate whether personal data is handled properly in everyday business |
In Brief | Compliance in processing | Sovereignty over access |
This makes GDPR compliance the foundation, not the ultimate goal. Data sovereignty is the concept that covers the other half. If you only check for GDPR compliance, you get clean processes but still carry a residual risk of data access by third parties. If you only look at sovereignty, you might have a European cloud, but no reliable deletion concept. For your company's compliance, you need both!
The CLOUD Act: Why US Law Reaches All the Way to Frankfurt
The 2018 CLOUD Act obligates US companies to disclose stored data to US authorities upon request, regardless of the country in which the servers are located. This affects not only US corporations themselves, but also subsidiaries under their control. As a result, this law collides with Art. 48 GDPR, which generally prohibits the disclosure of data to third-country authorities without a mutual legal assistance treaty. For businesses, this creates risks that can hardly be resolved through contracts.
Three key points that often get overlooked in practice:
The storage location does not protect you. The decisive factor is who has legal control over the data, not the physical data center.
Transparency is limited. Orders can be accompanied by a gag order. Under certain circumstances, those affected may never find out about it.
Providers cannot contract this away. In 2025, Microsoft was unable to guarantee under oath before the French Senate that European customer data would never reach US authorities.
On top of that, there is the situation with the transatlantic data privacy framework. Following the 2020 Schrems II ruling, the EU-US Data Privacy Framework has been in place since 2023. Although the General Court of the European Union upheld the adequacy decision on September 3, 2025 (Case T-553/23), the decision remains vulnerable, and political developments in the US continue to create uncertainty. For your tool selection, this means: relying solely on an adequacy decision to protect your data means building on a foundation that is always subject to change.
Data Residency, Data Sovereignty, and Digital Sovereignty: The Three Levels at a Glance
These terms are often mixed up. Properly separated, they serve as an excellent evaluation framework for cloud computing.
Level | Core Question | How to recognize it |
|---|---|---|
Data Residency (Data Localization) | In which regions are data stored and processed? | Contractually guaranteed locations, including backups, logs, and support systems |
Data Sovereignty | Which laws govern the data and the provider? | Company headquarters in the EU, with no controlling parent company in a third country |
Digital Sovereignty | How dependent is your organization on individual technologies? | Open APIs, clean export formats, open-source components, and no vendor lock-in |
It's only the third level that marks the true difference between "we are allowed to switch" and "we are actually able to switch". A provider that only lets you export data as a PDF is keeping you technically locked in, even if data sovereignty and residency are perfectly aligned. That's why digitalization always requires asking which technologies you could replace in an emergency. Open-source components and well-documented APIs significantly reduce this dependency.
Desk Sharing: Why sensitive data is often left exposed right here
With desk sharing, the data situation might seem harmless at first glance. After all, it's "just" about desks. In reality, however, daily use creates one of the most revealing data collections in the company:
Attendance over weeks and months: who was in the office when, and who predominantly works remotely
Spatial patterns: who regularly sits next to whom, and which teams mix
Temporal patterns: check-in and check-out times, no-shows, and short-term cancellations
Linkable information: bookings of parking spaces, visitors, or meeting rooms
In short, this data can easily be used to draw conclusions about behavior and performance. This is exactly why desk sharing is subject to co-determination: software suitable for monitoring behavior or performance falls under § 87 Paragraph 1 No. 6 of the German Works Constitution Act (BetrVG). The works council rightly takes a close look here, and nowadays they ask about much more than just the server location—they look at the entire setup.
What helps in practice: data minimization (only collecting what is absolutely necessary for the booking), short and configurable deletion periods, evaluations that are solely aggregated and anonymized, clear role and permission concepts for access, and a works agreement that specifies exactly that. Data protection and data security go hand in hand here!
Subprocessors: Where Cloud Solutions Quietly Lose Their Sovereignty
Sovereignty rarely fails at the main provider. It fails at the chain behind them. Every service that a software uses in the background is a sub-processor and belongs in the data processing agreement. Typical candidates:
Hosting and Backup: often a hyperscaler, sometimes with replication to other regions
Monitoring, Logging, and Error Analysis: frequently US services that record metadata and traffic
Email and Notification Delivery: booking confirmations containing names and times
Support and Ticket Systems: this is where screenshots with real personal data often end up
Analytics and Session Recording: an underestimated channel for sensitive information
AI Features: the key question is where the model is operated and whether inputs are used for training
A single provider from a third country is all it takes to break the chain. That is why the current list of sub-processors is the most honest document you can get from a cloud provider. It shows you in just five minutes whether data sovereignty is just a promise or a true operating model.
Sovereign Cloud: What It Needs to Deliver (And What It Doesn't)
The term sovereign cloud is often vague and claimed by many different models. It becomes practical when you measure it against clear criteria. At a minimum, a sovereign cloud should:
Store and process data exclusively in European data centers, including backups, logs, and testing systems
Only use subprocessors subject to European laws, fully documented and with advance notice of any changes
Provide operations and support from within the EU, with zero administrative access from third countries
Make key management transparent, ideally separating operation from key ownership
Ensure portability, meaning complete exports in open formats and fully documented APIs
What a sovereign cloud is not: a replacement for robust IT security. Certifications such as ISO 27001 or BSI C5, penetration testing, and an active information security management system remain essential. Data security and data sovereignty solve different challenges. While initiatives like Gaia-X and the EU Cloud Code of Conduct provide excellent guidance, they do not replace your own due diligence. And sovereignty is not an all-or-nothing deal: for many industries, a European provider with a clean chain of custody is perfect, while public authorities, healthcare, and other regulated sectors require stricter models.
10 Questions Companies Can Use to Take Control of Their Data
You can copy these questions directly into a vendor meeting or a request for proposal (RFP):
Where exactly is data stored and processed, including backups and logs?
Where is the company headquartered, and is there a parent company outside the EU?
Which sub-processors are used, and in which countries are they located?
How are changes to the sub-processor list announced, and what objection rights do we have?
From which regions are administrative access and customer support access carried out?
Who manages the keys, and how is encryption handled both in transit and at rest?
Which certifications are held, and when was the last external audit conducted?
What data is generated during desk sharing, what retention periods apply, and are they configurable?
What do reports look like, are they anonymized, and are insights traced back to individuals prevented?
How do we transition out? Think export formats, transition periods, and data deletion after contract termination.
If a provider struggles to answer questions 3 or 5, that tells you much more about the actual risks than any certificate on their website!
Data Sovereignty with anny: Opt for a Dedicated EU Cloud
With anny, standard operations are based in Germany, the infrastructure is ISO 27001-certified, and a comprehensive Data Processing Agreement (DPA) covers all GDPR requirements. On top of that, we embrace principles that are especially crucial for desk sharing: we only collect the data necessary for the booking, analytics run anonymously, and deletion periods can be customized to your needs.
Since data sovereignty is becoming a strict selection criterion for more and more companies, we also offer the anny EU Cloud: a dedicated environment utilizing exclusively European subprocessors. The difference isn't just a flag on the website, but the entire chain behind it. Demand is visibly growing, especially where works councils, corporate IT, and clients all require proof at the same time.
In the end, it’s not about ideology, it's about proof. When you can give a clear answer to the question "Where is our data stored and who legally governs it?", the discussion instantly loses its edge. And that is exactly where the practical value of data sovereignty lies.
FAQ: Your Guide to GDPR Compliance and Data Sovereignty with anny
What does data sovereignty mean?
Data sovereignty means that an organization retains control over where its data is stored, who can access it, and which laws apply to it. The focus is on access, not just on data storage.
Is software automatically GDPR-compliant if the servers are located in Germany?
No. The server location is just one piece of the puzzle. GDPR compliance also depends on data processing agreements, technical and organizational measures, deletion concepts, and whether data is transferred to third countries.
Does the CLOUD Act also apply to European subsidiaries of US providers?
According to the prevailing view, yes, provided the US parent company has power of disposal over the data. Having a European headquarters for the subsidiary alone does not reliably rule out access.
What is the difference between data privacy and data security?
Data privacy regulates whether and how personal data may be processed. Data security encompasses the measures and technologies that protect data from loss, manipulation, and unauthorized access. Data sovereignty complements both by addressing the question of legal jurisdiction.
What role do Gaia-X and the EU Cloud Code of Conduct play?
Both projects establish common criteria and greater transparency for European cloud services. They serve as a great guide during pre-selection, but do not replace your own audit of subprocessors and contracts.
What does the works council look out for in desk sharing tools?
Above all, they check whether behavior or performance can be deduced from the booking data. Typical topics include the scope of the information collected, retention periods, access rights, evaluation logic, and the question of who outside the company could have technical access.
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 120 40" xmlns="http://www.w3.org/2000/svg"><path d="M 55.501 13.158 L 59.216 13.158 L 59.216 30.294 L 55.501 30.294 L 55.501 27.83 C 54.088 29.78 52.094 30.741 49.482 30.741 C 47.113 30.741 45.112 29.883 43.427 28.138 C 41.743 26.393 40.919 24.23 40.919 21.729 C 40.919 19.192 41.743 17.073 43.427 15.321 C 45.112 13.576 47.106 12.718 49.482 12.718 C 52.094 12.718 54.088 13.678 55.501 15.599 Z M 50.071 27.207 C 51.616 27.207 52.925 26.693 53.955 25.667 C 54.986 24.604 55.501 23.306 55.501 21.729 C 55.501 20.153 54.986 18.855 53.955 17.821 C 52.925 16.758 51.616 16.245 50.071 16.245 C 48.526 16.245 47.216 16.758 46.186 17.821 C 45.156 18.848 44.641 20.153 44.641 21.729 C 44.641 23.306 45.156 24.611 46.186 25.667 C 47.216 26.693 48.526 27.207 50.071 27.207 Z M 79.191 19.771 L 79.191 30.294 L 75.475 30.294 L 75.475 20.153 C 75.475 17.586 73.997 16.179 71.628 16.179 C 69.016 16.179 67.265 17.792 67.265 21.113 L 67.265 30.294 L 63.549 30.294 L 63.549 13.158 L 67.265 13.158 L 67.265 15.357 C 68.398 13.612 70.149 12.718 72.591 12.718 C 76.542 12.718 79.191 15.387 79.191 19.771 Z M 98.82 19.771 L 98.82 30.294 L 95.104 30.294 L 95.104 20.153 C 95.104 17.586 93.626 16.179 91.257 16.179 C 88.645 16.179 86.894 17.792 86.894 21.113 L 86.894 30.294 L 83.178 30.294 L 83.178 13.158 L 86.894 13.158 L 86.894 15.357 C 88.027 13.612 89.778 12.718 92.22 12.718 C 96.171 12.718 98.82 15.387 98.82 19.771 Z M 114.049 13.158 L 118 13.158 L 111.401 30.836 C 109.753 35.258 106.964 37.384 103.013 37.142 L 103.013 33.689 C 105.353 33.828 106.655 32.691 107.59 30.33 L 107.759 29.986 L 100.468 13.158 L 104.522 13.158 L 109.642 25.593 Z M 36.232 8.186 C 36.188 5.033 35.879 2.203 35.827 1.77 C 35.798 1.066 35.371 0.458 34.694 0.164 C 33.959 -0.151 33.113 -0.004 32.539 0.531 C 19.487 12.828 19.413 12.916 19.377 12.96 C 19.229 13.128 19.156 13.224 19.082 13.334 L 19.075 13.348 C 19.053 13.385 19.031 13.414 19.009 13.451 C 18.84 13.737 18.744 14.147 18.766 14.477 C 18.788 14.807 18.862 15.152 19.001 15.511 C 19.023 15.592 19.046 15.665 19.075 15.739 C 19.2 16.091 19.568 17.161 19.641 21.003 C 19.722 25.102 19.207 26.965 18.935 27.962 C 18.884 28.138 18.847 28.292 18.81 28.438 C 18.766 28.578 18.656 28.952 18.759 29.465 C 18.81 29.707 18.906 29.912 18.965 30.022 C 18.994 30.074 19.023 30.125 19.06 30.176 C 19.119 30.264 19.215 30.404 19.369 30.536 L 26.712 37.487 C 27.065 37.824 27.536 38 28.014 38 C 28.271 38 28.536 37.949 28.779 37.839 C 29.456 37.545 29.875 36.929 29.875 36.218 L 29.875 24.42 C 29.875 23.504 29.419 22.924 29.073 22.565 L 28.978 22.462 C 29.706 21.803 31.943 19.764 34.452 17.227 C 35.717 15.944 36.298 12.989 36.232 8.186 Z M 27.624 34.605 C 27.624 34.847 27.33 34.972 27.153 34.803 L 21.363 29.326 L 21.378 29.311 L 21.407 29.282 L 21.495 29.194 L 21.532 29.157 C 21.569 29.12 21.606 29.091 21.643 29.054 C 21.65 29.047 21.665 29.04 21.672 29.025 C 21.724 28.981 21.775 28.93 21.827 28.878 L 21.841 28.864 C 21.893 28.82 21.937 28.776 21.988 28.724 C 22.003 28.71 22.018 28.702 22.033 28.688 C 22.084 28.636 22.136 28.592 22.194 28.541 C 22.261 28.482 22.319 28.424 22.386 28.365 L 22.665 28.116 L 22.754 28.035 L 27.308 23.958 L 27.44 24.098 C 27.447 24.105 27.455 24.112 27.455 24.12 C 27.631 24.303 27.631 24.34 27.631 24.428 L 27.631 34.605 Z M 32.848 15.658 C 29.875 18.657 27.278 20.967 27.256 20.989 L 27.249 20.989 L 26.623 21.546 L 25.792 22.294 C 24.586 23.372 23.173 24.633 22.187 25.52 C 21.996 25.689 21.701 25.535 21.724 25.285 C 21.841 24.171 21.915 22.756 21.885 20.945 C 21.804 16.743 21.378 15.511 21.194 14.983 C 21.186 14.969 21.179 14.954 21.179 14.939 C 21.157 14.844 21.135 14.778 21.12 14.741 C 21.106 14.705 21.091 14.668 21.083 14.639 C 21.047 14.536 21.076 14.426 21.157 14.353 C 22.239 13.326 29 6.954 33.252 2.951 C 33.422 2.789 33.694 2.899 33.716 3.127 C 33.826 4.293 33.966 6.214 33.995 8.23 C 34.062 13.971 33.135 15.365 32.848 15.658 Z M 17.302 27.955 C 17.03 26.957 16.522 25.095 16.596 20.996 C 16.669 17.146 17.044 16.076 17.162 15.731 C 17.184 15.658 17.214 15.585 17.236 15.504 C 17.368 15.152 17.449 14.8 17.471 14.47 C 17.493 14.147 17.39 13.737 17.228 13.444 C 17.206 13.407 17.184 13.378 17.162 13.341 L 17.155 13.326 C 17.081 13.224 17.008 13.121 16.86 12.952 C 16.824 12.908 16.743 12.828 3.698 0.538 C 3.125 -0.004 2.278 -0.144 1.543 0.172 C 0.866 0.465 0.439 1.074 0.41 1.778 C 0.358 2.21 0.049 5.041 0.005 8.193 C -0.061 12.996 0.52 15.951 1.793 17.234 C 4.316 19.786 6.568 21.839 7.267 22.47 L 7.171 22.572 C 6.825 22.932 6.369 23.511 6.369 24.428 L 6.369 36.211 C 6.369 36.922 6.788 37.545 7.465 37.831 C 7.715 37.941 7.973 37.993 8.23 37.993 C 8.709 37.993 9.172 37.817 9.533 37.479 L 16.912 30.499 C 17.044 30.382 17.133 30.25 17.184 30.184 C 17.221 30.132 17.25 30.081 17.272 30.044 C 17.346 29.92 17.442 29.722 17.486 29.472 C 17.581 28.974 17.478 28.6 17.434 28.446 C 17.398 28.284 17.353 28.13 17.302 27.955 Z M 3.389 15.658 C 3.102 15.365 2.168 13.979 2.249 8.237 C 2.278 6.221 2.426 4.3 2.529 3.134 C 2.551 2.907 2.823 2.797 2.992 2.958 C 7.245 6.962 14.006 13.334 15.087 14.36 C 15.161 14.433 15.19 14.543 15.161 14.646 C 15.154 14.675 15.139 14.712 15.124 14.749 C 15.109 14.785 15.087 14.851 15.065 14.947 C 15.058 14.961 15.058 14.976 15.051 14.991 C 14.867 15.519 14.44 16.75 14.359 20.952 C 14.322 22.763 14.396 24.178 14.521 25.293 C 14.55 25.542 14.249 25.696 14.057 25.527 C 13.071 24.64 11.659 23.379 10.452 22.301 L 9.621 21.553 L 8.988 20.989 C 8.871 20.893 6.325 18.62 3.389 15.658 Z M 9.077 34.81 C 8.9 34.979 8.606 34.854 8.606 34.612 L 8.606 24.42 C 8.606 24.34 8.606 24.296 8.782 24.112 C 8.79 24.105 8.797 24.098 8.797 24.09 L 8.929 23.951 L 13.476 28.028 L 13.792 28.314 L 13.851 28.365 C 13.866 28.38 13.881 28.394 13.895 28.402 C 13.932 28.438 13.976 28.475 14.013 28.512 C 14.035 28.534 14.057 28.548 14.072 28.57 C 14.109 28.607 14.153 28.644 14.19 28.68 C 14.212 28.695 14.227 28.717 14.249 28.732 C 14.293 28.776 14.337 28.812 14.381 28.856 L 14.41 28.886 C 14.462 28.937 14.513 28.981 14.558 29.025 L 14.587 29.054 C 14.624 29.091 14.661 29.12 14.69 29.157 L 14.727 29.194 C 14.756 29.223 14.793 29.26 14.815 29.289 L 14.837 29.311 L 14.852 29.326 Z" fill="rgb(0, 0, 0)" height="38px" id="bH388uk2E" transform="translate(1 1)" width="118.00000395534607px"/></svg>)