More than privacy: availability, dependence and costs

Module 1: Why a European cloud? · Reading time: 11 minutes

Learning objective: After this lesson, you can explain that digital sovereignty is also about availability, dependence and control, you know the new European switching rights under the Data Act, and you can weigh up the risks of your own situation.

Key concepts: digital sovereignty, availability risk, sanctions, unilateral changes to terms, vendor dependence (vendor lock-in), concentration risk, EU Data Act, switching right, switching costs, NIS2, weighing up (likelihood and impact)

Sovereignty is more than "who can read along"

The previous lessons were about confidentiality: who can view your data. But there are two more questions that matter just as much to an organisation:

1. Can you get to your data when you need it? (availability)
2. Can you decide for yourself, even if the provider wants something else? (control)

Together, this is called digital sovereignty: the extent to which you (or your country, or Europe) keep control over your digital data and services. The word sounds grand, but for Bakkerij De Korrel it's very practical: if Sanne can't open the delivery routes at six o'clock on Monday morning, twelve people end up waiting.

This is explanation, not legal advice.

Risk 1: your account can be shut down

A cloud service can restrict or cut off your access. Usually for ordinary reasons: an unpaid invoice, suspected misuse, an automated system that gets something wrong. Anyone who has ever had an account blocked at a big service knows how hard it is to get a human being on the line.

There's also a geopolitical version of this. A company must comply with the sanctions of the country it falls under. In February 2025, the US government imposed sanctions on the chief prosecutor of the International Criminal Court (ICC) in The Hague. In May 2025, the news agency AP reported that he had lost access to his work email at Microsoft. Microsoft has stated that it never stopped providing its services to the ICC; according to later reports, the ICC itself, under pressure from the sanctions, stopped releasing access to the mailbox. Exactly what happened is still disputed. But the example shows that the availability of a service depends on the politics of the provider's home country, not just on the technology.

A bakery is unlikely to run into sanctions. The broader point is that you depend on rules you have no influence over.

Risk 2: terms and prices change unilaterally

Cloud services work with subscriptions and general terms that the provider can change. Packages get merged, features move into a more expensive tier, or a new feature (such as AI) is added that raises the price or uses your data differently. Usually, you can only choose: accept, or leave. And leaving is hard once all your work is stored there. This is called vendor dependence, or vendor lock-in (lesson 2.3).

Risk 3: everything with one party

If your email, calendar, files, chat, passwords and sign-in for other services ("sign in with Google or Microsoft") all sit with a single provider, then one outage, one blocked account or one hacked password is enough to lose everything at once. This is called concentration risk. It applies to every provider, including a European one. Spreading things out and keeping your own backup (module 8) help.

The same thing happens at country level. In the Netherlands, discussion arose in 2025 and 2026 about Solvinity, the company that provides infrastructure for DigiD and MijnOverheid. The American company Kyndryl wanted to acquire it. After advice from the Bureau Toetsing Investeringen (Investment Screening Bureau), the Dutch State Secretary blocked the acquisition in May 2026 to protect the public interest; one concern was that the US government might gain access via the CLOUD Act. The example shows that the owner of a European provider can change too. A European service today could have a US parent company tomorrow. That's why an exit plan (lesson 8.2) belongs in every choice you make.

New European rules: the Data Act

The EU has created rules to make switching between cloud services easier, in the Data Act (Regulation (EU) 2023/2854). The regulation has applied since 12 September 2025. For cloud services (the law calls them "data processing services"), the rules are set out in Chapter VI (Articles 23 to 31). In short:

• A provider may not obstruct you if you want to switch to another provider or to your own servers, and must cooperate with the switch.
• The contract must, among other things, allow a notice period of at most two months, a transition period of in principle at most thirty days, and a period of at least thirty days to retrieve your data.
• Providers must be clear about costs in advance.
• Switching costs, including the costs of sending your data out (egress), could from the start only be charged at cost price, and are abolished entirely from 12 January 2027 (Article 29). Ordinary subscription fees and penalties for early termination of a fixed-term contract remain allowed.

This helps, but it doesn't solve everything. The law says you may take your data with you, not that it will work exactly the same way at the new service. Taking a Google document or a Teams chat history to a different environment remains tricky (modules 5, 6 and 7).

NIS2 in one paragraph

The European NIS2 Directive (Directive (EU) 2022/2555) requires medium and large organisations in important sectors to have their cybersecurity, and that of their suppliers, in order. A small bakery doesn't fall under it, but a supplier to such an organisation may well get questions about its own cloud services. NIS2 says nothing about European versus non-European, but it does say you must know the risks in your supply chain.

Weighing it up: not everything matters equally

You don't need to switch everything tomorrow. A level-headed assessment per component helps. For each risk, look at the likelihood that it happens and the impact if it does:

A table like this shows you where to start. The HR folder is small and sensitive: quick to move, with a lot to gain. Email is important but needs a careful plan (module 4). You might not take the chat history with you at all, but archive it instead.

A fair counterweight: the big American services are reliable, technically strong and familiar to your staff. Switching takes time and adjustment. The question isn't "right or wrong", but which risks you consciously choose to accept.

In practice: what this looks like with a provider

Ask every provider, including a European one: how do I get my data out, in what formats, and how long after cancellation can I still access it? At WebOké, for example, the Nextcloud guide explains how to move data between Nextclouds, and Nextcloud works with open standards such as WebDAV, CalDAV and CardDAV, so you can also move to a different provider. Other providers have similar export features; check whether they work without help from support.

Summary

• Digital sovereignty is about confidentiality, availability and control.
• An account can be shut down due to a mistake, a payment issue or sanctions; the ICC case (2025) shows that politics plays a role.
• Terms and prices can change unilaterally; keeping everything with one party creates concentration risk.
• The Data Act (applicable since 12 September 2025) grants switching rights; switching costs are abolished from 12 January 2027.
• Weigh up likelihood and impact per component and start where the gain is greatest.

Quiz

Exercise

Exercise A1.5: Your own risk weighting. For your own organisation, fill in per component (email, calendar, contacts, files, documents, chat, passwords, backups) how confidential it is, how bad an outage would be, and how hard it would be to leave. The program checks whether your weighting is complete and consistent and puts the components in order.

Exercise E1.5: Your reasoning in five sentences. Write down why your organisation does or doesn't want to switch (partially or fully), which risks you consciously accept, and what the most important argument is for your colleagues.

Further reading

The steps in these articles apply to WebOké's services; with other providers, it works in a similar way.

• Nextcloud manual 1.1: What is Nextcloud and what is a WebOké Nextcloud?
• Nextcloud manual 13.1: Preparing: what to bring and in which order
• Nextcloud manual 6.6: Backups with WebOké: what we keep and what you can do yourself
• Regulation (EU) 2023/2854 (Data Act), Chapter VI, Articles 23 to 31, on EUR-Lex
• Directive (EU) 2022/2555 (NIS2), on EUR-Lex