Sovereign Cloud was one of VMware’s big announcements at its annual VMware Explore Europe conference this year. Not that the company was announcing the still-evolving notion of sovereignty, but what it calls “sovereign-ready solutions.” Data sovereignty is the need to ensure data is managed according to local and national laws. This has always been important, so why has it become a thing now if it wasn’t three years ago?
Perhaps some of the impetus comes from General Data Protection Regulation (GDPR compliance), or at least the limitations revealed since its arrival in 2016. It isn’t possible to define a single set of laws or regulations around data that can apply globally. Different countries have different takes on what matters, move at different rates, and face different challenges. “Sovereignty was not specific to EMEA region but driven by it,” said Joe Baguley, EMEA CTO for VMware.
GDPR requirements are a subset of data privacy and protection requirements, but increasingly, governments are defining their own or sticking with what they already have. Some countries favor more stringent rules (Germany and Ghana spring to mind), and technology platforms need to be able to work with a multitude of policies rather than enforcing just one.
Enter the sovereign cloud, which is accelerating as a need even as it emerges as something concrete that organizations can use. In terms of the accelerating need, enterprises we speak to are talking of the increasing challenges faced when operating across national borders — as nations mature digitally, it’s no longer an option to ignore local data requirements.
At the same time, pressure is increasing. “Most organizations have a feeling of a burning platform,” remarked Laurent Allard, head of Sovereign Cloud EMEA for VMware. As well as regulation, the threat of ransomware is highly prevalent, driving a need for organizations to respond. Equally less urgent but no less important is the continuing focus on digital transformation — if ransomware is a stick, so transformation offers the carrot of opportunity.
Beyond these technical drivers is the very real challenge of rapidly shifting geopolitics. The conflict in Ukraine has caused irrecoverable damage to the idea that we might all get along, sharing data and offering services internationally without risk of change. Citizens and customers—that’s us—need a cast iron guarantee that the confidentiality, integrity, and availability of their data will be protected even as the world changes. And it’s not just about people—industrial and operational data subjects also need to be considered.
It is worth considering the primary scenarios to which data protection laws and sovereignty need to apply. The public sector and regulated industries have broader constraints on data privacy, so organizations in these areas may well see the need to have “a sovereign cloud” within which they operate. Other organizations may have certain data classes that need special treatment and see sovereign cloud architecture as a destination for these. And meanwhile, multinational companies may operate in countries that impose specific restrictions on small yet important subsets of data.
Despite the rapidly emerging need, the tech industry is not yet geared up to respond — not efficiently, anyway. I still speak to some US vendors who scratch their heads when the topic arises (though the European Data Act and other regulatory moves may drive more interest). Hyperscalers, in particular, are tussling with how to approach the challenge, given that US law already imposes requirements on data wherever it may be in the world.
“These are early days when it comes to solutions,” says Rajeev Bhardwaj, VP of Cloud Provider Solutions at VMware, “There is no standard for sovereign clouds.” Developing such a thing will not be straightforward, as (given the range of scenarios) solutions cannot be one-size-fits-all. Organizations must define infrastructure and data management capabilities that fit their own needs, considering how they move data and in which jurisdictions they operate.
VMware has made some headway in this, defining a sovereign cloud stack with multiple controls, e.g., on data residency — it’s this which serves as a basis for its sovereign-ready solutions. “There’s work to be done. We’re not done yet,” says Sumit Dhawan, President of VMware. This work cannot exist in isolation, as the whole point of the sovereign cloud is that it needs to work across what is today a highly complex and distributed IT environment, whatever the organization’s size.
Sure, it’s a work in progress, but at the same time, enterprises can think about the scenarios that matter to them, as well as the aforementioned carrot and stick. While the future may be uncertain, we can all be sure that we’ll need to understand our data assets and classify them, set policies according to our needs and the places where we operate, and develop our infrastructures to be more flexible and policy-driven.
I wouldn’t go as far as saying that enterprises need a chief sovereignty officer, but they should indeed be embedding the notion of data sovereignty into their strategic initiatives, both vertically (as a singular goal) and horizontally as a thread running through all aspects of business and IT. “What about data sovereignty aspects” should be a bullet point on the agenda of all digital transformation activity — sure, it is not a simple question to answer, but it is all the more important because of this.