What Customers Need to Know About Data Sovereignty
When I talk to customers about privacy and their data, the #1 topic is data sovereignty.
More and more organisations want their data to stay in a specific jurisdiction, with no transfer to, or access from, another region. A few years ago, this was something for lawyers and compliance teams to worry about. Now it is a regular item on the C-suite agenda because it touches cloud strategy, innovation projects, and how you run the business day to day.
Why sovereignty suddenly feels urgent
There are a few reasons this has moved so fast.
Regulation is one. In Europe, GDPR set the baseline and the EU Data Act has pushed things further. Many other countries have brought in their own rules about where data can be stored and who can access it from overseas. If you operate across multiple markets, that can quickly become a complex puzzle.
But this is not only about compliance. Governments and businesses are also thinking about digital autonomy and resilience. Who controls critical data? What happens if a region goes offline? What if regulations change, or a jurisdiction becomes politically sensitive?
These questions now show up in boardrooms when cloud contracts are renewed, when new projects are scoped, and when regulators start asking for more detail on data flows.
The organisations leaning into sovereignty today are not just trying to avoid penalties. They see an opportunity to design data architecture that is resilient by default, trusted by regulators, and easier to explain to customers.
A European viewpoint
Qlik has always viewed these questions through a strong European lens. We were founded in Sweden in 1993 and grew up in European markets. With the Talend acquisition, that footprint deepened, and our largest R&D hubs are in Sweden and France.
That matters. It means we have been dealing with European expectations on privacy, security, and sovereignty for a long time. We are close to our European customers and to local debates, whether they are about Schrems II, the EU Data Act, or sector-specific rules in healthcare and financial services.
Being grounded in Europe has shaped how we build products. We assume customers will ask tough questions about data flows, access rights, and encryption; so we design with those questions in mind from the start.
Why it is complicated (and why that is ok)
Data sovereignty is not simple. Most of our customers are global, even if they do not think of themselves that way. Their data is spread across multiple jurisdictions. Their architectures are hybrid or multi-cloud. Regulations move, and court decisions move with them.
We have been on this journey with customers for years, helping them understand things like:
Where their data actually flows
Which laws apply where, and when
How to design architectures that respect local rules without breaking the business
The conversation is rarely about a single system. It is about the whole pipeline: ingestion, integration, quality, transformation, analytics, services, and now new workloads on top. Every hop the data makes raises questions about sovereignty, privacy, and security.
There are challenges, but also real opportunities: to make data architecture more resilient, to tighten governance and gain a clear understanding of where your data resides, and to build trust with customers and regulators. When you can point to a clear design with clear controls, discussions with auditors, boards and customers become much easier.
How Qlik thinks about sovereignty
We try to keep our approach simple and consistent.
Three principles guide how we build:
You control your data – where it resides and who can access it
We give you governance tools – so you can meet your own regulatory and policy requirements
We are transparent – so you understand how our offerings function and can make informed choices
From these principles, a few practical things follow.
1. Control: where your data lives and who can see it
Location is usually the first question, and rightly so.
We have built multiple Qlik Cloud regions in Europe, including Ireland, Germany, the UK, and France, so European customers can keep data close to home and aligned with local residency requirements.
Our newest region, on the AWS Europe (Paris) Region, makes Qlik Cloud services available in France, allowing French enterprises and public sector organisations to process data locally if they wish, reduce latency, and meet policy requirements for hosting data in-country.
These regional choices mean you can align data residency with your business strategy, not just the limitations of a vendor’s infrastructure map. If you want certain workloads to stay in-country, you have a clear way to do that.
On top of that, Qlik Cloud is an encrypted, no-view service. Your data is encrypted, and access is under your control. You decide who sees what.
With Customer Managed Keys (CMK), you can go a step further and control your own encryption keys. That provides an extra layer of assurance, especially when you need to show that data cannot be accessed in response to external disclosure requests. For sectors like healthcare, finance, aerospace, and life sciences, this matters both for compliance and peace of mind.
2. Governance: seeing the whole picture
Sovereignty is not only about where data sits. It is also about how it moves and how it is used.
Qlik gives you visibility across the end-to-end data lifecycle, from sourcing and transformation through to analytics and new workloads that sit on top. You can:
Trace how data is used
Apply governance policies consistently
Reduce the risk of accidental non-compliance
Many organisations are focused on new technologies right now, and rightly so. However, those technologies are only as good as the data underneath them. If that data is poor quality, opaque, or not well governed, the outcomes will not be trustworthy, and regulators will notice.
We talk about this in more detail in Laying a Strong Data Foundation for AI. The short version is simple: governance comes first. You need to know what data you have, where it came from, how it is transformed, and who can see it, before you start depending on it for critical decisions.
Qlik’s role is to help you get that foundation in place so you can operationalise new capabilities with confidence, based on trusted, auditable data.
3. Privacy and transparency: not just box-ticking
From a privacy perspective, we give customers clear levers and the information they need to use them.
On the product side, that means:
Region selection
Fine-grained access controls
CMK and strong encryption
On the documentation side, it means:
A Product Privacy Notice that explains how our offerings handle data
Privacy Trust resources, including our International Data Transfers materials, which set out how cross-border flows are managed and protected
Privacy is always paired with security. Our security programme, certifications, and internal controls work together to protect customer data. Without that, privacy is just words on a page.
The aim is not to overwhelm you with paperwork. It is to make it easy to answer the kinds of questions your own privacy teams, CISOs, and regulators will ask.
Looking ahead: Sovereign Cloud with AWS
Expectations are rising, especially for governments and heavily regulated sectors. Some customers need stronger guarantees about where operational control sits and where services are delivered from.
That is why we recently announced that Qlik will be a launch partner for the AWS European Sovereign Cloud (“ESC”).
Qlik’s ESC data and analytics platform will run on infrastructure located in the State of Brandenburg, Germany, designed specifically for EU data residency and operational autonomy. It will be:
Fully featured
Operated independently from existing AWS regions
Backed by strong technical controls, sovereign assurances, and legal protections
Day-to-day operations, technical support, and customer service for Qlik on the AWS European Sovereign Cloud will be handled by Qlik employees residing in the EU.
As with our other regions, customers control access to their data. Neither Qlik nor AWS can access customer data. Customer Managed Keys will also be available in this environment, further reinforcing that control.
What this all adds up to
While regulators continue to refine sovereignty frameworks, customers still have to run their businesses. They need:
Clear choices about where data is stored
Confidence that encryption and access are under their control
Assurance that cloud environments meet regulatory expectations
Through partnerships with providers like AWS, including our region in France and our roadmap for Qlik ESC, in partnership with AWS, , we are trying to make the choice simple. You should not have to pick between innovation and compliance. Qlik provides the technical controls and legal assurances you need to meet your obligations and still move forward.
Our goal is to give you control, visibility, and choice so you can enforce consistent governance, reduce risk, and make trusted decisions in a world where data sovereignty will only matter more.