On This Page
Distinguish data location from control
A data centre in Germany or the EU initially answers a question about location. Contracting parties, ownership and control structures, applicable jurisdictions, subcontractors and actual access capabilities also matter. Administration and support may take place elsewhere.
Record where not only primary data but also backups, logs and metadata are processed. Check who approves, carries out and can trace access. For encrypted data, this includes who controls the keys and under what conditions plaintext access is possible.
Assess the specific service
A provider’s characteristics do not necessarily apply to every service it offers. A virtual machine, a managed database and an AI service create different dependencies. The relevant factors are the service used, its configuration and the associated protection requirements.
Request evidence covering precisely that scope. For a BSI C5 report, check in particular the services covered, period, exceptions and required customer-side measures. Such a report supports the security assessment. It does not replace a review of all sovereignty questions or an assessment of the specific use case.
Test portability in practice
Switching providers rarely involves only downloading records. Schemas, relationships, permissions, metadata, configurations and interfaces are often also needed. Applications bring additional requirements for runtime environments, dependencies and operational knowledge.
A small migration test shows whether these components are complete and understandable. Agree in advance which functionality must be demonstrated in the target environment. Record the adjustments, interruptions and costs that actually arise.
- Export data in a documented format
- Check completeness and relationships between data
- Save configurations and permissions separately
- Run a representative workflow in the target environment
- Document the result, effort and remaining obstacles
The Data Act sets out rules for switching between data processing services. Contractual rights and technical switching capabilities must be considered together. A right to receive data does not itself provide a suitable target architecture.
Include operations and recovery
A backup helps when data are lost or damaged. Only a recovery test demonstrates whether it can restore an operational service. Switching providers adds further requirements, such as different platforms, interfaces and responsibilities.
For both scenarios, clarify the access, skills, recovery times and responsibilities required. Monitoring, updates and security measures must continue to work during a migration. AI can help review and classify operational events, but does not replace clear accountability.
Make a well-founded decision
A European cloud may be suitable when the contract, technology, operations and protection requirements align. It may also make sense to retain a service initially and reduce specific dependencies. Record the reasons and the conditions for a later reassessment.
Autonomy Track helps connect provider claims with evidence, make outstanding questions visible and prioritise actions. This turns a label into a traceable decision.
Assess your next cloud service in detail
Choose a specific service and an important application. The guide helps you request evidence, assess switching options and document the result.