How countries pursue digital sovereignty.

Rules

• Decree 53/2022 (in force 1 October 2022) requires local providers handling certain data on telecom and internet services to store it in Vietnam. The data includes personal data of Vietnamese users, user-generated data and user relationship data.
• The Data Law (effective July 2025) and the Personal Data Protection Law (effective January 2026) add localisation rules for certain personal and important data.

Who builds it

• Viettel: operates 14 data centers, is building 11 more, and plans 24 by 2030 (about 560 MW). A 140 MW hyperscale site in Ho Chi Minh City started construction in April 2025.
• VNPT and FPT: domestic cloud, data center and virtual server offers.
• National Data Centre under the Ministry of Public Security: launched 25 February 2025.
• FPT and Viettel joined NVIDIA's sovereign AI programme (June 2026).

Model and watch-outs

Domestic operators first. No priced region from a global operator appears in our cost study, so in-country workloads land on Viettel, VNPT, FPT, CMC, VNG Cloud or Bizfly.

Watch: Kubernetes prices are mostly unpublished, so quotes are needed. Localisation scope is still being clarified by guidance, so take legal advice.

Rules

• 'AI for All' national strategy (announced 4 June 2026) names Canadian sovereignty as one of three guiding principles, with C$2 billion over five years for AI infrastructure, including the Sovereign AI Compute Infrastructure Program (C$890 million).
• A national intake (15 January to 15 February 2026) sought large-scale sovereign AI data centers.

Who builds it

• ThinkOn: Toronto-headquartered and Canadian-owned, Protected B status, sites in Toronto, Vancouver and Montréal. A consortium with Hypertec, Aptum and eStruxture launched what it calls Canada's first end-to-end sovereign government cloud in October 2025.
• TELUS: Kamloops AI Factory, with a Vancouver facility opening at the end of 2026.
• OVHcloud Canada: a non-US provider 'actively engaging' with the government on the sovereign cloud project.
• OpenText, Bell with SAP, and Bell with Hypertec have announced sovereign offers.

Model and watch-outs

Canadian-owned operators and a federal funding programme, with non-US foreign providers also engaged.

Watch: Definitions of 'sovereign' vary by announcement. Ask about ownership, control and legal exposure to foreign law.

Rules

• LGPD with ANPD Resolution 19/2024 on international data transfers (standard contractual clauses, adopted 23 August 2024, with a compliance deadline of 22 August 2025).

Who builds it

• Serpro and Dataprev: more than R$1.8 billion committed to sovereign cloud infrastructure, including servers and GPUs.
• Serpro 'Nuvem de Governo': runs Google, Huawei and AWS stacks in its own data centers, operated by public professionals, to keep sensitive data under Brazilian jurisdiction.
• Serpro is building two data centers (Brasília and São Paulo) and negotiating use of a Telebras data center in Brasília.
• A federal initiative with MGI, ABDI, Serpro and BNDES plans a call for proposals in 2026 for sovereign data infrastructure.

Model and watch-outs

Public operators host foreign stacks. Control sits with the state operator, not the vendor.

Watch: Commercial detail is still being set by the 2026 call for proposals and the Telebras talks.

Rules

• Cloud and AI Development Act (CADA), proposed 3 June 2026 as part of the Tech Sovereignty Package: Union assurance levels. Lower levels cover EU establishment, EU data localisation and transparency on subcontracting. Higher levels add ownership, control and exposure to third-country legal regimes.
• The EUCS certification scheme has been deadlocked since 2019 over excluding non-EU providers from top levels.

Who builds it

• Member-state programmes: France's SecNumCloud, Germany's C5 and domestic stacks.

Model and watch-outs

A common legal ladder instead of national schemes.

Watch: CADA is a proposal. Details can change before adoption.

Rules

• 'Cloud au centre' doctrine, rule R9: for sensitive data, the commercial cloud must hold SecNumCloud qualification and be immune to non-EU law.
• ANSSI SecNumCloud 3.2 is the qualification standard.

Who builds it

• S3NS (Thales with Google Cloud): PREMI3NS qualified SecNumCloud 3.2 on 17 December 2025, for IaaS, CaaS and PaaS together.
• Bleu (Orange and Capgemini, 50/50, with Microsoft technology) and Scaleway: listed as in progress, not granted, as of 6 October 2026.

Model and watch-outs

A legal and certification test that lets foreign technology in only through a French-controlled operator.

Watch: Qualification status moves. Check the ANSSI list for the specific service.

Rules

• BSI C5:2026 certifies cloud information security. Schwarz Digits' ES3 standard and the C3A catalog rate sovereignty across four maturity levels (operator, data sovereignty, independence from non-European access).

Who builds it

• STACKIT (Schwarz Digits): included in GovTech Deutschland's framework agreement worth up to EUR 250 million.
• IONOS and T Cloud Public (Open Telekom Cloud) are described as production-ready for regulated environments.

Model and watch-outs

Certification and procurement drive a domestic alternative. One trade report says no US hyperscaler made the shortlist of the EUR 250 million AI cloud tender.

Watch: Verify the procurement detail in the framework agreement itself, because the shortlist claim comes from a trade article.

Rules

• Swiss Government Cloud (SGC) programme: Parliament approved CHF 246.9 million in December 2024. FOITT leads the rollout from 2025 to 2032, at a cost of CHF 319.4 million.

Who builds it

• Infomaniak (Geneva): privately held, Tier III+ data centers in Switzerland, and a public cloud 'designed, operated and controlled in Switzerland' that added managed Kubernetes.
• Exoscale: zones in Switzerland, Germany, Austria and Bulgaria.
• The earlier 'Public Clouds Confederation' project (from November 2022) named Amazon, IBM, Microsoft, Oracle and Alibaba.

Model and watch-outs

A state programme for core government workloads, with a hyperscaler contract for scale.

Watch: The federal audit office reviewed the SGC programme in 2025, so expect scope changes.

Rules

• MeitY empanelment under the GI Cloud (MeghRaj) programme creates a trusted list of cloud providers for government and critical sectors. NIC runs the national government cloud.
• The Digital Personal Data Protection Act 2023, RBI circulars for financial data and MeitY or NIC requirements for government workloads drive local hosting.

Who builds it

• Yotta: hyperscale data centers in Navi Mumbai and Greater Noida, with Yntraa Cloud (MeitY-empanelled) and Shakti Cloud for AI.
• TCS: launched SovereignSecure Cloud aligned with data localisation needs.
• ESDS and others position MeitY-empanelled sovereign cloud offers.

Model and watch-outs

Empanelled domestic and foreign providers coexist. Sector regulators set the strictest localisation rules.

Watch: Residency is not the same as sovereignty. Check who controls operations and keys, not only where the servers sit.

Rules

• Government Regulation 71/2019: public electronic system operators must place systems and data in Indonesia. Private operators may use offshore locations unless a sector rule says otherwise, but must allow government supervision.

Who builds it

• Telkom Group and NeutraDC: 29 data centers nationwide, with up to 1 GW of AI data center capacity planned in Batam, Jabodetabek, Java and Manado, together with the Danantara fund (September 2026).
• PDNS (Pusat Data Nasional Sementara, the temporary national data center): sites in Surabaya, South Tangerang and Batam.

Model and watch-outs

State-owned operators carry government and sovereign AI plans. The June 2024 ransomware attack ('Brain Cipher') on the Surabaya PDNS affected more than 200 institutions, and reports say essential services were moved to third-party data centers including AWS. A corruption investigation into PDNS procurement followed.

Watch: Resilience and backup are the lesson: sovereignty on paper does not replace tested recovery.

Rules

• ISMAP sets security requirements for any cloud used by government, Japanese or foreign.
• The Digital Agency selected Sakura Internet and four US companies as government cloud providers for fiscal 2026 (March 2026). Sakura is the first domestic provider and met all 305 technical requirements.

Who builds it

• Sakura Internet: first domestic government cloud provider.

Model and watch-outs

Mixed panel with a domestic anchor, motivated by concern about foreign laws such as the US CLOUD Act.

Watch: The domestic share is small compared with the foreign providers on the panel.

Rules

• Personal data of Kazakhstan citizens must be stored on servers physically located in Kazakhstan. Updated guidance says the duty applies at the point of collection, and later transfers abroad are allowed only under specific conditions.
• A draft decree on data processing and storage infrastructure would lift mandatory storage of digital databases in Kazakhstan, allow cross-border transfer for most categories of personal data, and adopt a Cloud First principle for government data (AmCham brief, May 2026).

Who builds it

• Kazakhtelecom: a 50 MW AI-focused facility due for commissioning by June 2027.
• Beeline Kazakhstan (VEON): Tier III Hyper Cloud data center in Almaty, targeted to go live by the end of 2026.
• Government deal for a 'Data Center Valley' in Pavlodar involving NVIDIA and an Armenian-American cloud company (reported at USD 10 billion).
• NIT (National Information Technologies): state IT operator. We did not verify its cloud offer for this study.

Model and watch-outs

National telecom operators anchor sovereign capacity, with large foreign-backed AI projects alongside.

Watch: Rules are in flux. The draft decree would loosen localisation, so check which text is in force.

Rules

• National Cloud Computing Policy (2025): a framework that aims to establish sovereign cloud infrastructure and compliance with local law.
• MyDIGITAL cloud-first approach for the public sector, with a target to migrate 80% of public data to hybrid or public cloud in the 2026 to 2030 phase.

Who builds it

• MCMC: RM2 billion allocated in the 2026 budget for a sovereign AI cloud.
• Hyperscalers: Malaysia took over two-thirds of data center capacity under construction across Southeast Asia's five main economies, including Microsoft's multi-billion-dollar investment.

Model and watch-outs

Sovereign layer on top of a hyperscaler-heavy market. Local telcos such as Telekom Malaysia (VADS) also offer cloud.

Watch: The policy is recent. Look for the operational definition of 'sovereign cloud' before relying on it.

Rules

• Cloud Security Assurance Program (CSAP) certification for public sector cloud. KT Cloud holds the top tier and is the primary government cloud provider.

Who builds it

• KT Cloud: 13 data centers.
• Naver Cloud, NHN Cloud and Kakao: host the national GPU pool distributed by the Ministry of Science and ICT.
• Sovereign AI Foundation Model Project: LG AI Research, SK Telecom and Upstage advanced after the January 2026 evaluation, and Naver Cloud and NC AI were eliminated.

Model and watch-outs

State funds domestic clouds and models, with foreign chips and tools in the stack.

Watch: The programme narrows to two final teams by the end of 2026.

Rules

• Draft government guidelines require highly protected data, such as national security information, to sit in sovereign or state-controlled clouds in Thailand, and say all government data should be stored in Thailand.
• The Personal Data Protection Act (PDPA) applies to personal data.

Who builds it

• GDCC (Government Data Center and Cloud Service): run under the Ministry of Digital Economy and Society with National Telecom (NT) as infrastructure provider. It serves 219 agencies and 3,065 systems.
• True IDC: more than 49 MW across Bangkok sites and a USD 560 million loan (November 2025) for a 102.6 MW Rayong campus.

Model and watch-outs

A state cloud for government, plus private colocation operators that also host foreign cloud brands. True IDC lists Tencent Cloud among its services.

Watch: The classification guidelines were in draft form in the sources we found. Check the final text.

Rules

• NCA Cloud Cybersecurity Controls (CCC 2020): public sector and critical national infrastructure must keep related data in the Kingdom, with cloud services provided from inside KSA.
• SAMA rules add requirements for banks.

Who builds it

• HUMAIN (owned by the Public Investment Fund, launched 12 May 2025): data centers, AI cloud, the ALLaM Arabic model, and HUMAIN ONE. It tendered a 6 GW data center campus in east Riyadh and partners with NVIDIA, AMD and AWS.
• SITE Cloud: sovereign cloud operated locally under KSA law.
• stc Cloud and Mobily Cloud: telco clouds in in-Kingdom data centers.

Model and watch-outs

State capital builds national capacity and brings in foreign technology partners under Saudi control.

Watch: Check the NCA classification for your data. Hyperscaler residency promises are contractual, whereas the CCC expects technical enforcement.

Rules

• Federal Law No. 45 of 2021 (PDPL), in force 2 January 2022, covers personal data in mainland UAE. DIFC and ADGM run their own regimes.
• National Cloud Security Policy: cloud consumers must be aware of where data is stored, processed and managed from. Banking, health and finance have an expectation of in-country data.

Who builds it

• Core42 (G42): Sovereign Public Cloud with Microsoft in Abu Dhabi, a sovereign financial cloud with the UAE Central Bank (February 2026), and an MoU with the UAE Cybersecurity Council on a Signature Sovereign AI Cloud (September 2026).
• e& UAE: partnership with Core42 for Sovereign AI Compute in country.
• Khazna: data center operator linked to G42 and e&. We did not verify its capacity or ownership for this study.

Model and watch-outs

Sovereignty by partnership: a local operator controls the platform and keys, a foreign vendor supplies technology.

Watch: Check key custody and who operates the platform, which sources describe as the basis of sovereignty here.