Who Holds Your Keys? Why Data Sovereignty Is Becoming a Question of Control

For years, conversations about data sovereignty have tended to begin with location. Where is the data stored? Which region is the cloud environment in? Is it inside Ireland or elsewhere in the European Union? Those remain important questions, but on their own they leave a gap. An organisation can know precisely which data centre holds its information and still have a much less certain answer to a more fundamental question: who can actually access it?

That distinction between location and control is becoming increasingly important as organisations place more sensitive information, applications and infrastructure with global cloud providers.

Residency and sovereignty answer different questions

Choosing an EU cloud region can help organisations meet residency requirements and support their wider approach to GDPR, NIS2, DORA and risk management. The location of the server, however, does not by itself determine every jurisdiction that may apply to the provider operating it.

The US CLOUD Act makes explicit that communications service providers subject to US jurisdiction can be required to produce data within their possession, custody or control, regardless of where that data is physically stored. This does not make every piece of information held by a US-headquartered cloud provider automatically available to US authorities. Valid legal process is still required, and cross-border access to data involves important legal safeguards and potential conflicts of law. It does, though, expose an important distinction.

Residency tells you where your data is. Sovereignty is also about who ultimately controls access to it.

For organisations handling commercially sensitive information, intellectual property, public sector data or other information requiring long-term confidentiality, that distinction deserves more attention.

Encryption changes the conversation when you control the keys

Encryption is one of the foundations of modern cloud security, yet knowing that data is encrypted only answers part of the question. You also need to ask who controls the encryption keys. If the same provider storing and processing the data also controls the keys required to decrypt it, the organisation remains dependent on that provider's technical architecture, security controls and legal obligations.

Separating those responsibilities creates a very different model. Approaches such as Bring Your Own Key and Hold Your Own Key allow organisations to retain greater control over key material while continuing to use cloud infrastructure and services. The principle is straightforward: the system protecting the data and the system protecting the keys can sit under the control of different parties.

That matters for regulatory compliance and well beyond it. It can support separation of duties, reduce concentration of risk and provide stronger evidence of who has been able to access sensitive information, when and under what authority. It also changes the questions organisations should be asking during cloud procurement. Alongside where information will be stored, security and risk teams increasingly need to understand:

Who generates and controls the encryption keys?
Where are those keys stored?
Can the cloud provider access them?
What happens if access to a key needs to be revoked?
Can keys be moved between providers or environments?
What evidence exists showing when and how key material has been used?

These questions shape the architecture as much as the contract, and they are becoming more important as organisations consider a second challenge to today's encryption.

The cryptography protecting today's data has an expiry date

Quantum computing is often discussed as a problem waiting somewhere in the distant future, while the security industry is behaving as though it is much closer. In March 2026, Google set a 2029 timeline for its migration to post-quantum cryptography. Cloudflare subsequently brought forward its own target and is now aiming to achieve full post-quantum security across its product portfolio by 2029.

NIST has already finalised its first post-quantum cryptography standards and advises organisations to begin migrating systems to quantum-resistant cryptography. Its current transition plans aim to deprecate and ultimately remove quantum-vulnerable public-key algorithms from its standards by 2035, with higher-risk systems expected to transition sooner.

Whether a cryptographically relevant quantum computer arrives in 2029, 2032 or later matters less than one practical fact: cryptographic migrations take years. Large organisations may have encryption embedded across cloud platforms, applications, VPNs, certificates, identity systems, databases, hardware and third-party services, and before any of those systems can be migrated, an organisation first has to know they exist.

That is why one of the earliest steps in post-quantum preparation is establishing a cryptographic inventory, well before any algorithm is replaced. What encryption is being used, where, and for what purpose? Who owns the system? How long does the information being protected need to remain confidential? Can the cryptography be changed without rebuilding the underlying application? For many organisations, answering those questions will be a substantial project in itself.

The risk starts before a quantum computer arrives

There is another reason to treat this as a present concern. The concept is commonly described as harvest now, decrypt later: an attacker can capture and retain encrypted information today, with the expectation that future advances in computing will eventually make decryption possible. Cloudflare is already deploying post-quantum encryption specifically to mitigate this risk, while NIST and technology providers are encouraging organisations to begin the migration process before large-scale quantum computers become available.

For information that loses its sensitivity within days or months, that may have limited significance. For information expected to remain confidential for ten, twenty or thirty years, the calculation is very different, and the relevant question becomes: will the encryption protecting information today still be strong enough for the entire period that information needs to remain confidential? That brings the discussion back to control.

Crypto-agility is becoming part of cyber resilience

Moving to post-quantum algorithms will be one stage in a continuing process. Algorithms will be strengthened, deprecated or replaced, standards will change, new vulnerabilities will emerge, and cloud architectures and regulatory expectations will keep developing. Alongside strong cryptography, organisations therefore need crypto-agility: an understanding of where cryptographic controls exist and the ability to replace or update them without major disruption.

That also means thinking carefully about the role of key management and hardware security modules within the wider security architecture. The strategic objective is to create an environment in which cryptographic controls can evolve as the threat changes, which serves an organisation better over time than choosing the strongest algorithm available today and leaving it in place.

The sovereignty question is getting bigger

For Irish organisations, cloud sovereignty, encryption and post-quantum security can easily become separate projects, yet they are increasingly parts of the same question. Who controls access to your information? Who controls the keys protecting it? How easily could those protections be changed? And will the cryptography you rely on today remain suitable for the lifetime of the information it protects?

Knowing that your data sits within an EU region is useful. Knowing who holds the keys gives you a much clearer picture of who actually controls it.

Join Renaissance and Utimaco on 11th November

Renaissance is hosting a webinar with Utimaco on Wednesday 11th November 2026 at 10am exploring these questions in more detail.

Who Holds Your Keys? Data Sovereignty and Protection Against Tomorrow's Quantum Threats will look at the difference between data residency and sovereignty, independent encryption key management, BYOK and HYOK models, crypto-agility and the practical steps organisations can begin taking as they prepare for post-quantum cryptography.

The session is designed for IT, security and compliance leaders within Irish organisations, as well as MSPs, VARs and technology partners advising customers on cloud security, encryption and data sovereignty. You can sign up: https://renaissance.renaissance.ie/c/459108/