Data sovereignty
What is data sovereignty, and who needs it?
Data sovereignty means that data is subject to the laws of the country where it is stored and operated, and that its owner decides who can access it. It matters most to public bodies and to the companies that serve them. Walhalla hosts its Data Center and Cloud services in Spain, is a Spanish company, and holds the ENS High certification, the Spanish public-sector security framework, for the systems that support those services.
On this page
What does data sovereignty mean?
Data sovereignty is the principle that data is subject to the laws of the country where it is stored and processed. It is related to, but different from, data residency, which only says where the data is physically located. A third idea, operational control, covers who runs the infrastructure and can reach the data. In Europe, the GDPR restricts transfers of personal data outside the EU and the EEA, and laws from other jurisdictions, such as the US CLOUD Act, can require providers subject to them to hand over data even when it is stored in Europe. That is why many organisations ask for infrastructure that is located, owned and operated in their own jurisdiction, often called a sovereign cloud.
Who needs data sovereignty?
In practice, data sovereignty requirements apply to:
The whole public sector: central government, regional and local administrations, public universities and dependent bodies. In Spain they must also meet the ENS.
Private companies that provide services or supply solutions to public-sector bodies, and organisations in regulated sectors such as finance or health, for the systems that handle sensitive data.
That is why many integrators, MSPs and software vendors need to show where their customers’ data is hosted and which jurisdiction applies when they bid for public contracts or renew them, and they pass that requirement on to the infrastructure providers they depend on.
Sovereignty levels: standard, enhanced and strict
The level you need depends on how strict your requirement is in five areas: data location, jurisdiction, operational control, certification and portability. There are three levels:
Assess your case
How strict is your requirement in each area? The level is set by the strictest area.
Indicative assessment: the formal requirement comes from your sector, your contracts and your legal analysis.
Standard
Your caseFlexible requirement. Hosting in the EU or EEA with a provider subject to EU law is usually enough.
Enhanced
Your caseFirm requirement. Data in a defined country, a provider under its jurisdiction and independent certification such as ISO/IEC 27001.
Strict
Your caseStrict requirement. Data and operations in a single country, a provider under its jurisdiction and national certification where one exists, such as the ENS in Spain.
At the enhanced and strict levels, ask the provider for evidence you can verify: certificates, data location and who operates the service.
How to choose a provider when data sovereignty matters
A practical process follows these steps:
- 1Map your data and classify it by sensitivity.
- 2Define your requirements: data location, jurisdiction and operational control.
- 3Ask the provider for evidence: ownership, data location, operators and certificates.
- 4Verify the certificates and write the commitments into the contract.
- 5Review the commitments periodically and whenever the provider changes.
Step outcome
What should a provider offer when data sovereignty matters?
Hosting a system with a provider does not make that system sovereign: each organisation answers for how it configures and uses it. What the provider settles is the infrastructure layer: where it is located, who owns and operates it, which law applies to it and what evidence it can show, from the physical security of the data centre to energy, cooling, continuity and incident management, backed by valid certificates and the documentation behind them.
In Walhalla’s case, that includes:
ENS High certification, issued by AENOR, for the systems that support the Data Center and Cloud services.
ENS declaration of conformity under Royal Decree 311/2022, published on this website.
Complementary certifications UNE-EN ISO/IEC 27001:2023, UNE-ISO/IEC 20000-1:2018 and UNE-EN ISO 50001:2018.
Infrastructure and data in Spain, run by a Spanish company, with copies of the certificates available to any customer who asks.
For a partner whose customer needs data sovereignty, building on infrastructure that is located, certified and operated in Spain reduces the evidence work on the physical and operational side, and lets you focus on the customer’s own system.
The ENS and the NIS2 Directive
The NIS2 Directive extends cybersecurity obligations to new private sectors. Many of the risk-management measures it requires are already part of the ENS and ISO/IEC 27001, so an organisation that works with these frameworks starts with an advantage.
Frequently asked questions
What is the difference between data sovereignty and data residency?
Data residency is about where the data is physically stored. Data sovereignty also covers which country’s laws apply to it and who can access it. Data can reside in the EU and still be exposed to non-EU laws if the provider is subject to them.
Is data sovereignty a legal requirement?
There is no single law called data sovereignty. The requirements come from several sources: the GDPR for personal data, sector rules, the conditions of public contracts and, in Spain, the ENS for public-sector systems.
What is a sovereign cloud?
A sovereign cloud is cloud infrastructure located, owned and operated within a given jurisdiction, so that the customer’s data stays under that jurisdiction’s laws. There is no single legal definition, so ask each provider for specific evidence: data location, ownership, who operates the service and which certificates support it.
Where does Walhalla host the data, and which certifications support it?
In its own data centre in Castellón, Spain. The systems that support the Data Center and Cloud services hold ENS High certification, issued by AENOR, as well as ISO/IEC 27001, 20000-1 and 50001 certifications.
Shall we talk about your project?
If your customer needs data sovereignty, tell us your name, company and phone number, a brief description of the project and the service you are interested in. Someone from the sales team will reply.
