Data Sovereignty & SAP Sovereign Cloud: What do UKISUG members need to know?
For SAP user organisations in the UK, data residency, control and compliance are growing priorities. This is indicative of the wider UK business ecosystem, with recent research finding that over half of organisations consider digital sovereignty key to mitigating risk and building resilience.
Why does data sovereignty matter now?
Protecting critical data has always been important, but four factors have pushed data sovereignty up the agenda for many organisations:
-
Geopolitical fragmentation – New research has found that data and infrastructure concerns could push two-thirds of UK enterprises to move away from US cloud providers.
-
Regulatory complexity – Rather than having to contend with regulations, including the EU's GDPR and NIS2 or the US CLOUD Act, organisations can simplify compliance by onshoring data management.
-
Cybersecurity threats – In the 12 months to June 2026, the UK’s critical infrastructure faced 200 cyberattacks, with three quarters of these coming from state actors. Establishing data sovereignty can help major businesses and public sector organisations minimise the exposure of sensitive data.
-
Ability to innovate – Organisations in critical industries often have to operate in a closed system to reduce their attack surface. Sovereign clouds offer a secure environment to experiment with AI.
How do your data security needs define your cloud?
SAP user organisations can choose different cloud models according to their security, data control and compliance requirements:
-
Public Cloud – SAP’s Public Cloud is secure by design and suitable for all industries. All data that is at rest or in transit is robustly encrypted to keep it safe from unauthorised access.
-
Private Cloud – SAP Private Cloud contains all the same safeguards as public cloud but builds in greater data management controls. Users can directly manage who can access which data. This makes private cloud relevant to SAP users subject to specific regulatory or legal requirements.
-
Sovereign Cloud – SAP also offers its own Sovereign Cloud. SAP has committed to providing secure, localised cloud solutions to meet the needs of public sector organisations, critical national infrastructure, and highly regulated industries, combining data security and the opportunity for innovation.
How is SAP Sovereign Cloud different?
SAP Sovereign Cloud is designed with four pillars in mind:
-
Data – data is stored in-country to adhere to infrastructure requirements.
-
Legal – designed to reinforce governance, all legal entities are based locally to mitigate the risk of data exposure to foreign authorities.
-
Operational – operations are kept in-region, with maintenance and administration restricted to approved personnel.
-
Technical – all control planes are locally deployed and tenants are separated through encryption.
The moving target of data sovereignty
The conversation around data sovereignty continues to evolve and so do SAP’s cloud offerings. As your User Group, we’ll continue engaging with SAP and keeping our members updated on the latest developments.
