Digital sovereignty: what the EU Data Boundary does and does not solve

Two years ago digital sovereignty was a debate for government ministries and healthcare umbrella organisations. Today the question shows up in ordinary SMB procurement terms: *where is our data, who can access it, and under which jurisdiction does that fall?* Not because everyone suddenly became a lawyer, but because clients pass the question down to their suppliers — exactly as happens with NIS2.

Microsoft has delivered substantially on this over the past year. The EU Data Boundary is complete, and the sovereignty portfolio has expanded considerably. This article explains what that actually solves, what it does not solve, and how to make a sensible choice as an SMB without ending up in a trench war of principle.

What the EU Data Boundary is

The EU Data Boundary means Microsoft stores and processes customer data and pseudonymised personal data for its core services within the EU and EFTA countries. That now applies to Microsoft 365, Dynamics 365, Power Platform and the vast majority of Azure.

What matters about the latest expansion round: the boundary now also covers the parts that previously fell outside it — AI processing, Copilot interactions, telemetry and confidential computing. For Microsoft 365 Copilot, processing has additionally been pulled in-country across a growing number of countries.

That is more than a marketing promise. For the most frequently asked question — "is our mail sitting in America?" — the answer for European customers is now simply no.

Sovereignty is more than where the disk sits

The more interesting shift is in how Microsoft reframes the question itself. Sovereignty has long stopped being only about data residency; it breaks down into four questions you need to answer separately:

Most organisations that say "we want sovereignty" actually mean one or two of these four. It pays to get that clear first — it saves a lot of expensive solutions to problems you do not have.

What the EU Data Boundary does not solve

Honesty is called for here, because it tends to be missing from the brochures. The US CLOUD Act has not been repealed. As long as a US parent company controls a service, US authorities can in theory demand data — regardless of where that data physically sits. Microsoft contests this legally and publishes transparency reports about it, but it cannot offer an absolute guarantee. Microsoft does not claim otherwise.

For the vast majority of SMBs that is an acceptable residual risk: the chance that a US prosecutor takes an interest in the quotations of an installation company in Brabant is negligible. But it is the point where the discussion tips for some sectors — healthcare, legal, defence-related supply chains, and organisations under an explicit instruction from their own regulator.

How to approach this practically as an SMB

Not all-or-nothing, but per type of data. This is how we handle it with clients:

That last row is structurally overlooked. The EU Data Boundary is about *where* your data sits, not about whether it is retained. A deleted mailbox or a ransomware encryption is not a residency issue.

Where we stand ourselves

We believe you can only give this kind of advice if you practise it. Our online workspaces and cloud servers run in Dutch, ISO 27001-certified data centres, administered by a Dutch team. Last year we also moved our own virtualisation layer from VMware to XCP-ng — partly for cost reasons, partly because we did not want to depend on a single vendor that can overturn its licensing model overnight. That story is in from VMware to XCP-ng.

At the same time we are not an anti-Microsoft outfit. For mail, collaboration and Office, Microsoft 365 is simply the best choice for SMBs, and with the EU Data Boundary the biggest objection on paper has been removed. The art is in the combination: Microsoft where it is strong, Dutch hosting where control matters.

Four questions for your IT provider

If you want to know how sovereign you actually are, ask these four:

1. In which country is our data — and where are the backups? Those two answers differ surprisingly often.
2. Who can technically access it, and from which country? Operational sovereignty is rarely verified.
3. What happens if we want to leave? Do we get our data in a usable format, and within what timeframe?
4. Where is this recorded? In the data processing agreement, or only in a sales pitch?

We answer all four in writing. If your current provider does the same, you are in good shape — and we will simply say so.

Want us to take a look?

Unsure where your data sits and whether that matches what your clients expect of you? Take the free IT check — seven questions, and you receive a personal roadmap. Prefer to discuss your cloud setup directly? Book a consultation, no obligation, via Teams or by phone. Already know what you need? Request a quote.

*This article describes the situation as of August 2026 based on Microsoft's publications on the EU Data Boundary and the Sovereign Cloud portfolio. It is a high-level explanation and not legal advice.*