Why data sovereignty is now a dealbreaker in cybersecurity

In cybersecurity, so much emphasis has traditionally been placed on confidentiality — keeping data safe from prying eyes. But true cyber resilience hinges on the full CIA triad: confidentiality, integrity, and availability; a foundational model in cybersecurity. It is not just about keeping data private; it is about ensuring that it is accurate, trustworthy, and accessible when needed. And now, with growing pressure from regulatory frameworks and geopolitical tensions, another “letter” is rising in importance: L for location. Where your data lives and who has jurisdiction over it has become a defining factor in how organizations secure, manage, and control their most sensitive assets. 

As organizations across Europe assess their vendor relationships, data sovereignty has emerged as a board-level, make-or-break factor, one with real regulatory, reputational, and geopolitical consequences. New research from Foundry, conducted in partnership with CIO, CSO, and COMPUTERWOCHE, reveals a sharp shift in priorities among German enterprises. The message is clear: control, compliance, and sovereignty have become key in cybersecurity decision-making. 

It’s not just about skill; it’s about control 

For years, security leaders have prioritized technical chops when evaluating vendors. But the tide is turning. In this new study, 114 IT and business decision-makers from midsize and large German companies were asked to rank their most important criteria for digital sovereignty. The top response was clear: control over data infrastructure — in other words, data residency — was cited by 67% of all companies, and by 72% of large enterprises. This outranked other factors such as technical independence (58%), compliance and data protection (56%), business continuity (35%), in-house cybersecurity expertise (33%), and quality of partnerships (17%). 

When it comes to selecting IT security providers, the research found the most valued attributes were technological expertise (68%) and data security/compliance (64%), while only 10% of respondents considered certifications a top factor. The physical location of the provider or data center was important to a minority (29% and 19%, respectively). 

The takeaway? While trust is still built on expertise and compliance, control over data infrastructure now sits at the top of the buying agenda—well ahead of certifications or even in-house expertise. Today, transparency, compliance, and especially data control are what earn trust.