Creating the foundations for digital excellence and a smarter state
Afshin Attari
The UK government has promoted a Cloud First policy for over a decade to reduce technical debt and modernise legacy systems, driving widespread adoption of public cloud services. These services, typically delivered by global hyperscalers, offer scalability and cost efficiency. However, rising concerns about jurisdictional risk are increasing focus on digital independence.
Gartner predicts that sovereign cloud IaaS spending will shift 20% of workloads from global to local providers this year, primarily led by government adoption. As a result, data sovereignty is becoming central to public sector cloud procurement.
The geopolitical case for sovereignty
Global tensions, stricter legal scrutiny over data location, and the rapid development of AI are prompting organisations to reassess not just where data is stored, but who controls and accesses it. This marks a shift from a cloud-only mindset to one focused on sovereign, secure, and resilient architectures - especially for public services handling sensitive citizen data or critical infrastructure.
Geopolitical instability and evolving cyber threats have exposed vulnerabilities, making public sector organisations prime targets. Ensuring data integrity is now a priority, both to avoid financial and reputational damage and to reassure citizens that their data is protected in transit and at rest. However, the widespread use of cloud platforms and increasingly complex compliance requirements have blurred the definition of true data sovereignty.
Digital independence for data resilience
Modern conditions demand a broader understanding of sovereignty. It is no longer limited to physical data location but includes governance, legal jurisdiction, and assurance that data remains under UK control. For the public sector, this aligns with national priorities such as protecting citizen data and ensuring systems remain resilient during crises. Sovereign cloud is therefore becoming a core component of risk management.
Achieving resilience requires translating strategic intent into operational outcomes. While sovereignty is often associated with where data is hosted, interconnected supply chains and regulatory complexity challenge this assumption. Even if servers are located within the UK, data in transit may not remain within national borders, and global hyperscalers may be subject to foreign regulations.
The US CLOUD Act illustrates this risk, allowing US authorities to access data held by US companies regardless of where it is stored. This undermines jurisdictional control. Additionally, true sovereignty must extend to backup and disaster recovery environments, which should also reside within the same region and incorporate safeguards such as encryption, air gapping, zero-trust security, and regular audits. The objective is to ensure data remains within UK governance while maintaining performance and durability.
Control without compromise
Sovereign cloud does not require abandoning public cloud advantages. Hybrid models, combining private sovereign infrastructure with public cloud scalability, offer a balanced approach. These enable organisations to distribute workloads based on security, performance, and compliance needs, maintaining control while leveraging flexibility.
This approach is particularly valuable during periods of high demand or crisis, allowing services to scale without compromising governance. Sovereign platforms can integrate with public cloud ecosystems like Microsoft Azure, supporting disaster recovery and scalability while maintaining a resilient multi-cloud environment.
At the same time, public services increasingly depend on data sharing across systems to deliver better outcomes. For example, the NHS must connect datasets to support integrated care, analytics, and AI-driven decision-making, while safeguarding highly sensitive information. This creates a dual requirement: enabling interoperability while maintaining strict control over data governance.
Private cloud environments can help meet this need by reducing risk. The Peninsula Pathology Network demonstrates this approach. Serving multiple NHS trusts, it has adopted a private cloud strategy to improve operational continuity, collaboration, and innovation. Supporting over 39 million tests annually, the infrastructure enables easier second opinions, specialist referrals, and strong business continuity, while preparing for AI integration. This illustrates how sovereign private infrastructure can enable innovation while preserving control and resilience.
From cloud first to sovereign by design
Although the Cloud First policy has delivered significant benefits, it was designed for a different context. Today’s environment - defined by persistent cyber threats, geopolitical uncertainty, and evolving legal frameworks - requires a new approach.
Embedding sovereignty into cloud strategies, supported by partners with expertise in both technology and national security, will help ensure service continuity, compliance with UK law, and protection against external jurisdictional risks.
The focus is shifting from cloud-first to sovereign-by-design: secure by default and resilient by necessity, ultimately improving public service delivery while maintaining public trust.
techUK - Transforming Public Services
techUK members are transforming public services in the UK. Our community help to shape a smarter, digitally empowered public sector.
techUK drives public sector digital transformation by uniting the public sector and tech industry. Through early market engagement, efficient procurement, and innovative technology adoption, we help to modernise legacy IT, and enable efficient, secure, and personalised services.
Get involved: We run a busy calendar of activity including events, reports, and insights that demonstrate some of the most significant digital transformation opportunities for the sector. Our Transforming Public Services Hub is where you will find details of all upcoming activities. We also send a monthly public services newsletter to which you can subscribe here.
Upcoming 'Transforming Public Services' events
Latest news and insights
More resources
Authors
