Data sovereignty: why it matters and what EU data centres change
Kort antwoord
Data sovereignty is about where your data physically sits and which country's laws apply to it, not just how it's technically secured. Under GDPR, and increasingly under NIS2, European organisations need to be able to show where personal and sensitive data lives and who can reach it. If your provider is headquartered outside the EU, or stores data outside the EU, laws such as the US CLOUD Act can give a foreign government a route to that data even while it physically sits on European soil. Worldstream runs its own data centres in the Netherlands, and dedicated servers can be ordered in the Netherlands or Germany.
What data sovereignty actually means
Data sovereignty is the idea that data is subject to the laws of the country it's stored in, and, in some readings, the laws that apply to the company that controls it. For a Dutch or other EU business, that mostly comes up as a compliance question: can you show a regulator, an auditor, or a customer exactly where personal or sensitive data is stored, who can access it, and under which legal system that access is governed?
It sounds abstract until a specific scenario makes it concrete: a foreign government compelling a cloud provider to hand over data that belongs to a European company, about European individuals, stored in a European data centre. Whether that's even possible depends less on where the servers are and more on where the provider is headquartered and which laws it answers to.
The regulatory backdrop: GDPR and NIS2
GDPR is the general reason data location and access control matter for any organisation handling personal data in the EU. NIS2 adds to that for many organisations by extending supply chain risk obligations. Article 21 of NIS2 specifically requires in-scope organisations to assess risk in their supply chain, including the infrastructure providers they depend on. That means the jurisdiction and ownership structure of your hosting provider isn't just a background detail, it's something you may need to document and justify.
The non-EU jurisdiction risk: why it's not only about where the server sits
A common assumption is that choosing an EU data centre is enough on its own. It isn't, if the company operating that data centre is headquartered outside the EU. The clearest example is the US CLOUD Act, which can require US-headquartered providers to produce data they control, regardless of whether that data is physically stored in the US, the EU, or anywhere else. The physical location of the disk doesn't change which legal system the provider itself is answerable to.
That's the specific exposure to weigh: not just "is my data in the EU", but "could a non-EU legal system reach my data through the company that operates the infrastructure it sits on". For organisations handling personal data, regulated data, or anything that falls under NIS2 supply chain scrutiny, that distinction is exactly what an auditor or regulator will want to see addressed.
Why a provider's jurisdiction and ownership matter
Worldstream runs its own data centres in the Netherlands, and dedicated servers can be ordered in the Netherlands or Germany. Whether a law like the CLOUD Act could reach your data through a foreign parent company or a foreign jurisdiction depends on a provider's ownership and corporate structure, not only on where the servers sit. For compliance-conscious customers, that is the relevant question to ask any provider: who ultimately controls the infrastructure, not only where the disks are.