Sovereign AI Part 3 - Data sovereignty and cloud infrastructure

Data Sovereignty is the ability of a state to ensure data collected and processed within its jurisdiction is protected and that it will not be interfered with by foreign companies or states.

The government passed the Data Protection Act 2018, with the intent of protecting the data of British citizens. However, our current reliance on American cloud infrastructure poses potential risks to the data of British citizens. The US CLOUD Act, also passed in 2018, allows the US government to demand access to data held by US companies, even if that data belongs to non-Americans abroad. Therefore, companies like Amazon, hosting AWS cloud services or Microsoft, hosting Azure, could be required to hand over data even if it is data not held in the US or is the data of non-Americans. This creates a potential tension with UK data protection requirements and raises questions about the extent to which the UK can guarantee the sovereignty of data held by US-owned cloud providers. While legal safeguards and agreements exist to govern cross-border access, they do not entirely remove the underlying jurisdictional risk. Risks to the data of British citizens in this manner would undermine confidence in the state and its ability to protect those it is charged to protect. 

There is some nuance to the US Cloud Act, which mitigates some of the risk that it will undermine UK, and EU, data sovereignty. For example, the US government would need a warrant to request access to the data held by the company in question, and the involvement of the data of non-Americans would make the process of requesting the data harder. However, these are roadblocks, not guarantees, or ironclad provisions which would prevent the US government accessing the data of non-Americans, especially if this was deemed in the national interest. Moreover, the mitigations do not account for variations in approach between different US administrations.

Therefore, for the UK, one of its strategic priorities must be data sovereignty and native cloud capability, especially for the most sensitive government data. If cloud capability is outsourced, as it currently is for the majority of public sector bodies, then the data will always be at risk, as the companies which hold it are subject to other laws, which could be invoked in times of crisis, conflict or other necessity, however so defined.
Furthermore, the risk to data is not hypothetical. In 2024, Microsoft admitted to Scottish policing bodies that it was unable to guarantee that the police data it held would remain in the UK despite the obvious sensitivity of such data. The disclosure resulted from an initial Freedom of Information Request (FOI) which revealed that data held in Microsoft’s cloud infrastructure had been processed and transferred overseas. The recipient of the FOI, Owen Sayers, who is an enterprise architect, said of Microsoft: ‘They’ve confirmed for the first time that a guarantee of sovereignty for data at rest [which is what they give] does not extend to data being processed.’ In short, while data not in use was stored in the UK, when the data was being processed, it did get transferred outside of the UK. Sayers argues that this processing outside the UK violated UK data protection law.

While data storage requirements are currently tiered according to their sensitivity level, there is still an ongoing risk, as seen. It is clear that data sovereignty is essential and ‘cloud infrastructure is becoming a strategic asset - and, in some cases, a weapon. We’re seeing a rise in state-sponsored cybercrime, espionage, and proxy attacks targeting critical systems. Sovereign clouds offer a layer of resilience and control that’s becoming essential - not just for compliance, but for national security’ as Director of the ANS platform, Chris Folkerd writes. 

Emma Burnett, the Head of Data Protection at law firm CMS, writes that in the UK ‘there is currently no government policy that directly prevents public sector organisations from storing or processing cloud-based data in any specific country’. There are currently different rules around the use of foreign cloud providers – if it is [Secret] or [Top Secret] it does need to be in UK sovereign cloud rather than foreign owned cloud. However, this doesn’t apply for [Official]. Arguably, to ensure complete security, the policies should be amended to ensure all government data, regardless of its security classification, should be held in UK sovereign cloud. A transition would be required to undertake the large quantities of data migration needed, but if sovereignty is a years and decades long process, then there is no reason to think it cannot be done. This idea of data sovereignty aligns much more with what is traditionally described as data localisation.

Data localisation is a more restrictive concept which applies to sensitive and classified data which needs to be kept within a particular jurisdiction. Burnett also argues that where data localisation is pursued, a sovereign cloud or national cloud solution (offered by various providers) would be the best solution. Finally, it should not be forgotten that data sovereignty also impacts cybersecurity strategy as data is highly decentralised and any storage and processing is inherently subject to various vulnerabilities. Therefore, achieving data sovereignty will not be a simple task and it will require the expertise and collaboration of developers, engineers, cybersecurity professionals, legal experts and regulatory authorities, amongst many others. 

Ultimately, developing native cloud capability and ensuring data sovereignty is crucial, especially in the public sector which holds large quantities of citizens’ data as well as other sensitive and classified information.