Data sovereignty: a strategy issue, not just an IT one

A topic changing hands

For a long time, the question of where a company's data is hosted belonged to the head of IT, with a lawyer's opinion at the end of the process. That division of labour no longer holds. Three developments have stacked up: more demanding regulation, a concentration of digital services among a small number of providers, and generative AI, which multiplies the flows of data towards third parties.

On the regulatory side, the revised Swiss Federal Act on Data Protection (FADP) has been in force since 1 September 2023. It strengthens information duties, requires processing to be documented, frames the disclosure of data abroad and provides criminal penalties that target individuals, meaning executives themselves. In Europe, the AI Act entered into force on 1 August 2024 and applies in phases: prohibitions from February 2025, obligations for general-purpose AI models from August 2025, and most other obligations from August 2026. A Swiss company serving customers in the Union is exposed to both frameworks.

Yet these texts are only the visible part. The real question is strategic: whom do we depend on, for which data, and what happens if that relationship changes in nature?

Three levels of sovereignty

We find it useful to separate three levels, each calling for different decisions.

The legal level. This concerns the jurisdiction that applies to the data. Hosting in Switzerland or Europe with a provider whose parent company is subject to foreign law, such as the US CLOUD Act, does not offer the same assurance as a fully local provider. The difference matters, though it is not always decisive: it depends on the nature of the data.

The operational level. This concerns continuity. If the provider suspends a service, changes its terms or suffers a long outage, can the company keep producing, invoicing and delivering? Executive teams know this as risk management, but they rarely apply it to digital services.

The economic level. This is the most neglected. The more data, processes and team habits are locked into a platform, the higher the exit cost, and the stronger the provider's hand at renewal. Sovereignty is then measured in francs or euros: it is the price of being able to say no.

A worked example

Consider an illustrative case, with explicit assumptions. An industrial company of 400 people generates CHF 120 million in revenue. Its ERP, CRM and product lifecycle management run as SaaS from a non-European vendor, at an annual cost of CHF 1.2 million.

Suppose the vendor announces a 12 percent increase at renewal. That is about CHF 144,000 a year. Suppose also that moving to another solution would take 18 to 24 months and cost, all in, in the order of CHF 2 to 3 million, because the data sits in a proprietary format and the integrations were built on vendor-specific interfaces.

Under these conditions the increase will be accepted: the threat of leaving is not credible. Had the company invested, say, 3 to 5 percent of the annual contract each year (CHF 36,000 to 60,000) in regular exports in open formats, documented interfaces and an annual recovery test, the exit cost could be brought down to a fraction of the initial figure. The negotiation then changes character. These numbers are orders of magnitude specific to this example, but the reasoning is general: reversibility is an insurance premium, to be compared with the cost of dependency.

What this changes for decision-making

Classify data on three criteria

Trying to repatriate everything is unrealistic and expensive. We recommend classifying data sets by strategic value (know-how, formulas, pricing, customer data), operational criticality and regulatory exposure (personal data, trade secrets, sector obligations). A small minority of data sets typically meets all three criteria. That is where the sovereignty requirement should be high and the extra cost justified. For the rest, a solid international provider with clear contractual terms is an entirely rational choice.

Pay for reversibility where it matters

For critical data sets, four requirements, contractual and technical, are often enough: a complete export in an open format, documented interfaces, exit clauses with defined timelines and assistance, and a recovery test carried out at least once a year. The last is the one most rarely honoured, and the most revealing.

Bring AI into the same trade-off

Every AI project that sends data to a model hosted by a third party is a sovereignty decision. In 2025, the year AI has to show results we argued that AI should be judged on measurable outcomes. We would add that it should also be judged on what it exposes. And as From pilot to scale: why so many AI projects stall explains, a pilot that sidesteps the data question often runs into it at the moment of scaling, when the lawyer, the customer or the auditor finally asks the questions that had been postponed.

Read sovereignty into the strategic plan

Platform choices commit a company for five to ten years, beyond the horizon of most budgets. They belong in the roadmap, alongside industrial investments. A plan that ignores these dependencies is fragile, a point we develop in The three-year strategic plan that survives its first quarter. For a company preparing to expand, the question is very concrete: preparing for US market entry means deciding which customer data and which systems will be hosted where, and under which legal regime.

A trade-off, not a doctrine

Sovereignty has a cost: providers that are sometimes less rich in functionality, heavier integrations, skills to maintain. It therefore competes with other projects and should be handled as such, in a portfolio logic, as in our use case on project portfolio rebalancing. The CFO has a central role: exit cost, likely price increases and the risk of disruption are part of performance discipline, which we address in our Finance & performance expertise.

Three questions are enough to start at executive committee level. Which five data sets would cost us the most if lost or leaked? How much time and money would it take to leave each of the providers hosting them? Which AI project, current or planned, changes that exposure? The answers usually point to two or three priority workstreams, not a general overhaul.

This approach is part of how we handle strategy and value creation: decide first, deploy next, steer the results. If you want to know where your costliest dependencies lie and which trade-offs deserve attention first, our diagnostic is the most direct place to begin.