Who can read our data, who can switch off our services, and who makes what they run on?

Why now

Several reference points moved in the last year. In July 2026 HM Treasury designated four cloud providers as critical third parties to the UK financial sector, and oversight by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority began. The EU’s financial supervisory authorities designated 19 critical ICT third-party providers under the Digital Operational Resilience Act in November 2025. The EU renewed its adequacy decisions for the UK in December 2025, to run until 27 December 2031. In the United States, FISA Section 702 was repealed on 12 June 2026, according to the Congressional Research Service, although authorisations granted before then run until they expire and other US surveillance powers are unaffected. We take no view on what any of this means for a particular organisation. The resources below are about having a method that keeps working when the reference points move.

Two resources that cover all three questions

European Commission — Cloud Sovereignty Framework

Published by

European Commission, Directorate-General for Digital Services (DIGIT). We have no relationship with the Commission and inclusion here is not an endorsement in either direction.

Version

Version 1.2.1, October 2025 (document face); Commission page dated 20 October 2025.

Status

Written for the Commission’s own cloud procurement. It has no legal force outside it.

Availability

Free, English, on the Commission website.

The framework scores cloud services against eight weighted sovereignty objectives, from SEAL-0 “No Sovereignty” to SEAL-4 “Full Digital Sovereignty”. Five of them line up with the three questions:

• Who can read our data? SOV-2 Legal & Jurisdictional (10%) and SOV-3 Data & AI Sovereignty (10%).
• Who can switch off our services? SOV-4 Operational Sovereignty (15%) — including whether you can migrate without lock-in, whether EU operators can run the service without the non-EU vendor, and whether documentation and source code are available.
• Who makes what they run on? SOV-5 Supply Chain Sovereignty (20%, the highest weight) and SOV-6 Technology Sovereignty (15%) — including hardware and firmware provenance, where software is written and updated, sub-supplier visibility and audit rights, and open standards.

Outside the Commission, its use is as a structured set of supplier due-diligence questions.

House of Lords Library — Digital and technology policy and national sovereignty

Published by

House of Lords Library, In Focus briefing, 16 July 2026.

Status

A library briefing. The Library describes its briefings as providing “impartial, authoritative, politically balanced information in support of Members’ parliamentary duties”; they are not committee or government policy.

Availability

Free, on the Lords Library website.

The briefing notes that digital sovereignty “is often framed around three layers”: infrastructure and physical (servers, data centres, networks, cloud), code and standards (software, algorithms, protocols, technical standards), and data and content (how data is stored, processed, moved and owned). That is close to the three questions, and it is a useful UK starting point for anyone briefing a board.

Who can read our data?

CNIL — Practical guide: Transfer Impact Assessment, with template

Published by

Commission nationale de l’informatique et des libertés (CNIL), France. We have no relationship with the CNIL.

Version

Final version, January 2025 (document face); published on the CNIL site 9 July 2025, after a consultation that drew 34 contributions. The earlier January 2024 consultation draft is a separate document.

Language

English and French. A customisable template (.ods) is provided.

Status

Not mandatory; the CNIL says other methods may be used.

Six steps, each with a table to complete: know your transfer; identify the transfer tool; assess the law and practice of the destination country; identify and adopt supplementary measures; implement them; and reassess at appropriate intervals. The last step is the one that matters when the law at the other end changes.

ICO — Completing a transfer risk assessment, and the TRA tool

Published by

Information Commissioner’s Office (UK). Last updated 15 January 2026.

Status

Guidance plus an optional template.

The ICO now explains that “A transfer risk assessment (TRA) is now referred to in UK legislation as a ‘data protection test’”, reflecting the Data (Use and Access) Act 2025. For US transfers, exporters may rely on the UK government’s September 2023 analysis of US law, but the ICO adds: “You must regularly review any published updates to the DSIT analysis”, and “If DSIT changes the conclusions you referred to in your TRA, you must review and update your TRA accordingly.”

The UK divergence, stated plainly. The CNIL guide follows the EU method (EDPB Recommendations 01/2020 on supplementary measures). A UK exporter works to the ICO’s data protection test. The two should not be mixed in one document; the CNIL steps are a useful structure to compare against.

Also on this question: the General Court dismissed the challenge to the EU–US Data Privacy Framework in September 2025 (T-553/23), and that judgment is under appeal (C-703/25 P, lodged 31 October 2025). The EU Data Act, Article 32, requires cloud providers to inform customers of a third-country authority’s request for non-personal data before complying, except in limited law-enforcement cases. The Irish Data Protection Commission’s TikTok decision of 2 May 2025 (€530 million) treated remote access from China as a transfer; it is under appeal and, as reported, a stay is in place. For groups with US operations, the US Department of Justice’s Data Security Program (28 CFR Part 202) and its Compliance Guide set due-diligence and audit obligations effective from October 2025; China’s outbound rules sit in CAC Orders No. 16 and No. 20 (Chinese only).

Who can switch off our services?

UK — the Critical Third Parties regime

Instruments

The Critical Third Parties (Designation) Regulations 2026 (SI 2026/777), made 8 July 2026, in force 13 July 2026; with the Bank of England, PRA and FCA policy statement PS16/24 (12 November 2024).

Designated

Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited.

Scope

Third parties critical to the UK financial sector.

Designated providers must report operational incidents, test against severe but plausible scenarios and provide self-assessments that are shared with the firms they serve. The FCA is clear that firms “remain responsible for managing their own third-party arrangements, including due diligence, risk management and contingency planning”. A designation is about concentration and substitutability, not conduct, and says nothing adverse about any provider. Outside financial services, the same questions — how concentrated are we, how substitutable is the service, have we tested leaving — may be worth asking of any critical supplier.

EU — DORA Article 28(8) exit strategies, and the designated critical ICT providers

Instrument

Digital Operational Resilience Act, Regulation (EU) 2022/2554, applicable from 17 January 2025. The European Supervisory Authorities (EBA, EIOPA, ESMA) designated 19 critical ICT third-party providers on 18 November 2025.

Scope

EU financial entities; ICT services supporting critical or important functions.

Article 28(8) requires financial entities to be able to exit contractual arrangements without “disruption to their business activities”, without “limiting compliance with regulatory requirements” and without “detriment to the continuity and quality of services provided to clients”. Exit plans “shall be comprehensive, documented” and “sufficiently tested and reviewed periodically”, with alternative solutions and transition plans identified. It is the most concrete legal statement we have found of what a tested exit plan has to contain, and non-financial organisations may find it a useful benchmark.

Also on this question: the EU Data Act gives cloud customers switching rights — a maximum notice period of two months, a transitional period of at most 30 calendar days (extendable only where switching is technically unfeasible), and no switching charges from 12 January 2027. The Commission has published draft model contractual terms for cloud contracts (C(2025) 7750, still a draft). In the UK, the Competition and Markets Authority’s cloud services market investigation (final decision 31 July 2025) was followed in March 2026 by voluntary actions by two providers on egress fees and interoperability. The UK Cyber Security and Resilience (Network and Information Systems) Bill, at Lords Report stage from 26 October 2026, would allow a regulator to designate “critical suppliers”; it is a Bill and may change.

Who makes what they run on?

NCSC — Supply chain security guidance

Published by

National Cyber Security Centre (UK). Version 1.0, published 28 January 2018, reviewed 22 October 2025.

Status

Guidance; free.

Twelve principles in four stages: understand the risks (including knowing who your suppliers are and what their security looks like), establish control (including building security into contracting and requiring suppliers to do the same), check your arrangements (building assurance into supply-chain management), and continuous improvement (including building trust with suppliers). It is a UK practitioner method for seeing what your suppliers depend on.

NIS Cooperation Group — EU ICT Supply Chain Security Toolbox

Published by

The NIS Cooperation Group (EU Member States, the European Commission and ENISA); published on the Commission site 13 February 2026.

Status

Adopted toolbox, with two sector risk assessments.

A common EU method to identify, assess and mitigate ICT supply-chain risk, including measures to reduce dependence on high-risk suppliers.

Also on this question: the Commission’s 2023 Communication on implementing the 5G cybersecurity Toolbox, and the UK designated vendor direction requiring removal of Huawei equipment from 5G networks by 31 December 2027. To watch: the Commission’s Communication on European Tech Sovereignty with an EU Open Source Strategy (COM(2026) 503) and the proposed Cloud and AI Development Act (COM(2026) 502), both 3 June 2026 — proposals, not yet law.

Related on the Hub: Cyberspace Administration of China · Case law, including Schrems II · EDPB Recommendations 1/2026 on processor BCRs (draft) · Datatilsynet (Denmark) on supervising processors · International data transfers publications

Each resource is linked to its primary source. If you spot something out of date, please use the suggest-a-correction link, and we hope you find it useful.