The vocabulary, without the consultancy fog.
24 entries. Each opens with a sentence you can quote in a meeting, then goes deeper.
24 of 24
- Law
Adequacy decision
While it stands, data may flow to the US. It can fall at any time.
- Technology
C5, EUCS and SecNumCloud
An attestation audits operations, not jurisdiction. Two different questions.
- Law
Cyber Resilience Act
Software becomes a product with safety duties. Including the software you run yourself.
- Practice
Data processing agreements and sub-processors
Your vendor's sub-processor list is the most honest dependency map you can get for free.
- Technology
Data residency and data sovereignty
A server location is an address. Jurisdiction is an authority.
- Technology
Data trustee
A European operator between you and the US vendor. Works when the vendor is genuinely out.
- Law
Digital Markets Act
Forces the largest platforms to keep their doors open. Using that is up to you.
- Practice
Digital sovereignty
Not self-sufficiency, but the ability to decide: you can leave if you have to.
- Law
DORA
Forces financial firms to plan and rehearse leaving an IT provider.
- Law
EU AI Act
Regulates AI risk and transparency, not location. Location becomes an issue anyway.
- Law
EU Data Act
Since September 2025 no cloud provider may charge you for leaving.
- Practice
Exit strategy
A clause in a contract is a guess. A completed export is proof.
- Law
FISA 702
The reason the EU Court of Justice has struck down a data deal twice.
- Policy
Gaia-X and EuroStack
A lot of paper, little product. The useful parts now go by other names.
- Technology
Key control (BYOK and HYOK)
Encryption with provider-held keys protects against thieves, not against authorities.
- Law
NIS2
Forces companies to know their IT supply chain. That is exactly step one towards sovereignty.
- Technology
Open standards and interoperability
An open format is the cheapest exit there is — it costs nothing and works immediately.
- Policy
Public money, public code
Open source does not mean free of charge. It means nobody can lock you out.
- Law
Schrems II
Since 2020 you must check for yourself whether your data is really protected in the destination country.
- Practice
Shadow IT
What nobody approved, nobody can secure. Bans make it worse.
- Technology
Sovereign cloud
A word with no definition. Ask who pulls the plug in an emergency.
- Practice
Sovereign workplace
Email, files, chat, documents without Microsoft. Technically solved, humanly hard.
- Law
US CLOUD Act
US providers must hand over data even when it sits in Frankfurt.
- Practice
Vendor lock-in
Not the impossibility of leaving, but its price. That price can be measured.