The State of Sovereign Cloud 2026
Data residency stopped being a preference and became law. This is a cited, primary-sourced briefing on where cloud sovereignty stands in 2026 — the regulation, the market, and the lock-in. Free to quote.
01Regulation: residency is now the law
The rules that turned sovereignty from a talking point into a procurement filter.
The EU Data Act (Regulation (EU) 2023/2854) entered into force 11 January 2024 and became applicable 12 September 2025.
The Data Act will entirely remove switching charges, including data-egress fees, from 12 January 2027. Chapter VI also mandates open interfaces, functional equivalence, and the removal of obstacles to switching cloud providers.
The US CLOUD Act (2018), codified at 18 U.S.C. § 2713, requires US providers to preserve and disclose data “regardless of whether such communication, record, or other information is located within or outside of the United States.”
Under GDPR (Reg. (EU) 2016/679, Chapter V), transfers of personal data outside the EU/EEA require an adequacy decision or safeguards. The current basis for US commercial transfers is the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795, adopted 10 July 2023).
The Cloud and AI Development Act (CADA) was adopted as a Commission proposal on 3 June 2026 — the first EU-wide, four-level cloud/AI sovereignty assurance framework, aiming to at least triple EU data-centre capacity within 5–7 years, and it explicitly names the US CLOUD Act as a sovereignty risk to assess.estimate
India’s DPDP Act 2023 received assent 11 August 2023; the DPDP Rules 2025 were notified 14 November 2025, beginning an 18-month phased rollout to ~May 2027. Cross-border-transfer rules and Significant Data Fiduciary duties enforce from 14 November 2026; penalties reach ₹250 crore, with 72-hour breach reporting.
02The market: concentration, measured
Revenue data, not projections, on who holds Europe’s cloud.
Three US hyperscalers hold 70% of Europe’s cloud market. European providers’ share fell from 29% (2017) to ~15% (2022) and has held flat at ~15% since. Europe’s cloud market reached €61 billion (US$70 billion) in 2024.
The global sovereign cloud market is estimated in the range of US$104–113 billion in 2024–2025, growing to roughly US$298–479 billion by 2030 (analyst CAGRs of 23–27%).estimate
03Lock-in: the walls come down
Both largest providers dropped exit-egress fees within weeks of the EU Data Act’s switching rules — concrete evidence the barrier was real.
Google Cloud eliminated data-transfer fees for customers migrating their data off Google Cloud — announced 11 January 2024.
AWS waived data-transfer-out-to-internet (egress) charges for customers migrating off AWS — announced 5 March 2024.
04Agents: the new operator
AI agents are moving into production infrastructure — and the market is separating signal from hype.
Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027, driven by cost, unclear business value, and risk — a signal that agent deployments need infrastructure built for them, not bolted on.
05India: localization goes global
Data residency is not only a European story.
The RBI has required all payment-system data to be “stored in a system only in India” since its directive dated 6 April 2018.
The IndiaAI Mission — over ₹10,300 crore across five years — includes deploying over 10,000 GPUs of sovereign compute capacity via public-private partnership; approved 7 March 2024.
About this briefing
Every figure links to a primary or authoritative source — regulators, EUR-Lex and the US Code, official company engineering blogs, and Synergy Research’s own release. Market-size figures and the CADA framework detail are the only items relying on analyst or third-party sources, and are flagged as estimates. Journalists and researchers are welcome to cite this page and its underlying sources freely.
Press or data questions: hello@scalix.world · Compiled by Scalix World · Last updated 23 July 2026.