UK IT leaders voice concerns over data sovereignty risks

New research commissioned by Civo has found that a substantial majority of UK IT leaders are concerned that geopolitical events may undermine their ability to retain control and access to their data.

The study surveyed over 1,000 UK-based IT decision-makers and found that 83% worry about the impact of international developments on data sovereignty, a topic that has recently moved to the forefront of boardroom discussions.

According to the research, 61% of IT leaders in the UK now consider data sovereignty a strategic priority, indicating a significant shift from previous years when such concerns were less prominent. Much of this heightened awareness is attributed to ongoing geopolitical uncertainty and the continued influence of foreign legislation, such as the U.S. CLOUD Act, on local data infrastructure.

Visibility gap

Despite the strategic focus on sovereignty, a notable challenge persists regarding transparency. The report reveals that only 35% of survey respondents have complete knowledge of the location and jurisdiction in which their organisation's data is hosted. This lack of visibility presents potential risks for businesses seeking to manage compliance and security requirements effectively.

More than half of the surveyed organisations (54%) have implemented digital migration strategies in the past year, suggesting many firms are already rethinking their digital infrastructure to account for sovereign concerns and future regulatory demands.

Motivations for sovereignty

Respondents overwhelmingly cited operational and legal factors as core drivers of the increased focus on data sovereignty. The survey found that 96% of IT leaders highlighted the need to retain access to data, 85% referenced compliance with multi-jurisdictional regulations, and 84% expressed concerns about unauthorised third-party access.

The legislative landscape, particularly external laws such as the U.S. CLOUD Act, remains a decisive factor for many organisations. Even if data is stored locally by major global cloud providers, the research suggests there is no guarantee that foreign authorities will not demand or obtain access to that data. This exposure increasingly applies to companies with American parent firms as well as those relying on assurances of local compliance from hyperscale cloud providers.

The report notes that European public and private sector operators are paying more attention to these risks following recent announcements from providers promising new sovereign solutions in Europe and the UK, alongside high-profile technology partnerships by major industry players.

Industry response

"Our latest findings show that sovereignty is no longer a niche concern or compliance checkbox. It's foundational. Businesses are waking up to the fact that without clear, reliable control over where their data resides—and who has access to it—they're exposing themselves to unnecessary risk. The cloud needs to evolve to meet this new reality, and that means prioritising transparency, localised control, and trust at the very core of infrastructure."

According to Civo, while cloud computing provides organisations with access to scalable infrastructure, the lack of transparency around data hosting locations exposes them to potential breaches of legal requirements and operational vulnerabilities. The company argues that cloud providers must adapt by offering greater transparency and ensuring that data sovereignty is built into their services from the outset.

Civo's research indicates that decision-makers are increasingly seeking solutions that give them explicit oversight over data handling and storage. However, the report found that a wide gap remains between the level of control many organisations desire and what current service providers typically offer.

Organisations are under added pressure from ongoing geopolitical instability, which can swiftly alter data access arrangements for firms operating in multiple jurisdictions. The report suggests the UK technology sector is monitoring both legislative developments abroad and offerings from cloud providers promising to respect local sovereignty requirements.

The full research was based on a survey of 1,006 UK-based IT leaders, conducted in mid-2025. The findings underline the view among UK technology executives that sovereignty has become a key element of digital and commercial strategy as businesses continue to adapt to evolving political and legal contexts.