Weekly Guidance Watch — 12 October 2026
Each week we surface a few resources that may help you do the work — authoritative guidance, tools, frameworks and the definitive reports — including the excellent-but-hard-to-find material you would otherwise only meet by accident. This is deliberately not another feed of legislation news or fines; it is about what a privacy specialist would benefit from knowing about, and we hope you find it useful.
This week: sovereignty in three questions — who can read our data, who can switch off our services, and who makes what they run on?
Sovereignty is usually discussed as strategy. For a privacy, risk or resilience team it tends to arrive as three practical questions — a framing we first heard from Mark Watts at an event hosted by Bristows. This week we surface eight resources from UK and EU regulators, government and parliamentary researchers: two that cover all three questions, then two for each one. We take no view on any government’s policy or any provider; the resources are about having a method that keeps working when the reference points move. We hope you find it useful.
1 · Framing: the Commission’s Cloud Sovereignty Framework and a Lords Library briefing
European Commission (DG DIGIT) · v1.2.1, October 2025 · House of Lords Library In Focus, 16 July 2026 · new this week
Is there one set of questions that covers all three? The Commission’s framework, written for its own cloud procurement, scores services against eight weighted objectives, five of which line up with the three questions. The Lords Library briefing frames digital sovereignty in three layers — infrastructure, code and standards, and data — a useful UK starting point for a board briefing.
2 · Who can read our data? CNIL TIA guide and the ICO’s transfer risk assessment tool
CNIL (France) · final version January 2025, English and French · ICO (UK) · updated 15 January 2026 · new this week
If the law changed tomorrow in a country you send data to, would your transfer assessment still hold? The CNIL’s six-step method ends with reassessing at intervals; the ICO’s guidance now uses the Data (Use and Access) Act’s “data protection test” and tells exporters relying on the UK government’s US analysis to review it when it changes. The EU and UK methods differ, and our page says how.
3 · Who can switch off our services? The UK Critical Third Parties regime and DORA exit strategies
HM Treasury, SI 2026/777 (in force 13 July 2026) and Bank of England/PRA/FCA PS16/24 · EU Regulation 2022/2554, Article 28(8) · new this week
What does a tested exit plan actually have to contain? Four cloud providers are now designated as critical third parties to the UK financial sector, while firms stay responsible for their own contingency planning. DORA requires EU financial entities to be able to exit without disruption, with exit plans that are comprehensive, documented and sufficiently tested — a benchmark others may find useful.
4 · Who makes what they run on? NCSC supply chain principles and the EU ICT Supply Chain Security Toolbox
National Cyber Security Centre (UK) · reviewed 22 October 2025 · NIS Cooperation Group (EU) · 13 February 2026 · new this week
How far down your supply chain can you actually see? The NCSC’s twelve principles run from knowing who your suppliers are to building assurance and trust; the EU toolbox gives a common method for assessing and reducing dependence on high-risk suppliers.
Browse all back issues → Subscribe by RSS
The RSS feed carries every resource as we surface it. It sets no cookies and collects nothing about you — your reader fetches the file, and we never know who you are.