Published on: April 26, 2025 / update from: April 26, 2025 - Author: Konrad Wolfenstein
Safe server location in Germany? Data sovereignty in the cloud: Why the server location Germany is not sufficient! - Image: Xpert.digital
Why the server location does not guarantee data security
The illusion of the “Safe Server location Germany”
The conviction that data on servers in Germany is automatically protected against foreign access is a dangerous error. This analysis illuminates why the physical location alone does not guarantee data security and which measures are necessary for real data sovereignty.
Many companies in Germany incorrectly assume that storing their data on servers within Germany offers adequate protection against unwanted access. However, this assumption overlooks a decisive factor: the nationality of the cloud provider and the associated legal obligations are far more important than the physical location of data processing.
The Cloud Act (Clarifying LawFul Overseas Use of Data Act) is a US law that came into force in 2018 and obliges US companies, including its international subsidiaries, to publish stored data on request to US authorities-regardless of where they are physically stored. Specifically, this means: If a company uses AWS, Google Cloud, Microsoft Azure or other US-based services, the data is potentially subject to American access, even if they are located on servers in Frankfurt, Berlin or Munich.
The scope of this law is often underestimated: "The cloud act forces US cloud providers such as Google Cloud, Microsoft Azure, Amazon Web Services or Dropbox to make the data stored in the cloud access to the request of US authorities." The consequence is clear: "It actually overrides the regulations of the GDPR."
Suitable for:
The fundamental conflict between US law and European data protection
The conflict between the Cloud Act and the European General Data Protection Regulation (GDPR) presents companies in front of an unsolvable dilemma. U.S. providers with server locations in the EU undertake to grant US authorities access to their servers, even though this prohibits them. This legal discrepancy creates a permanent area of tension in which compliance with both legal frames is practically impossible.
The problem goes beyond pure data protection and concerns the basic question of data sovereignty. Due to the potential access options of US authorities, “companies in fact lose sovereignty over their information and thus about their intellectual property”, which is particularly critical of business and company secrets.
The legal development: from Schrems II to the EU-US-US Data Privacy Framework
The legal situation has developed through several court decisions and new agreements. The “Schrems II” judgment of the European Court of Justice of July 2020 declared “EU-US Privacy Shield” invalid because the US surveillance practices were not compatible with European data protection standards. This judgment significantly made data transmission to the USA significantly.
In July 2023, the new EU-US Data Privacy Framework (DPF) was accepted by the European Commission. This is intended to address the concerns from the Schrems II judgment: "The new framework is intended to address these concerns through protective measures that restrict the access to EU data through US secret services and by setting up a review court that can order the deletion of EU citizens' data if they have been collected by violating the protective measures."
Nevertheless, this framework remains controversial. It only applies until June 27, 2025, whereby the European Commission recently proposed to extend the appropriate decisions for the United Kingdom for another six months. The stability of this legal basis is therefore by no means guaranteed.
The actual risks for German companies
The use of US cloud services harbors concrete risks for German companies:
- Data protection injuries: The Cloud Act enables US authorities access to sensitive data without the knowledge of the actual data owner, which violates the GDPR.
- Legal dilemma: companies are facing a dilemma-either they break the GDPR by following the cloud act, or they refuse data transmission to US authorities and thus violate US law. In both cases, fines threaten.
- Loss of control over intellectual property: The potential access to business secrets, strategic plans and research results is particularly critical.
- A lack of transparency: Access by US authorities can be carried out without information from the company concerned.
Suitable for:
Real data sovereignty: alternatives to US cloud providers
In order to achieve real data sovereignty, companies have to consider alternative strategies:
1. European cloud provider as a safe alternative
An effective solution is to switch to cloud providers based in the EU that is not subject to the cloud act. Examples of this are:
- Ionos Cloud: As a European provider, Ionos is subject to the strict data protection laws of the EU and ensures full control over the data. Since the data is saved in Germany, you are protected from access from abroad. Ionos works in accordance with GDPR and fulfills the highest security and compliance standards, including ISO 27001, BSI IT basic protection and C5 test.
- Hetzner: offers GDPR-compliant hosting services and does not transfer any customer master data to third countries. Even their cloud services in the USA and Singapore are GDPR-compliant because the customer master data remain at Hetzner Online GmbH and are not transferred to subsidiaries.
The advantages of European providers are obvious: "As a European provider, Ionos is subject to the strict data protection laws of the EU and thus ensures full control over your data."
2. Successful migration examples
The feasibility of such migrations shows the example of Open Data Denmark, which switched from Google Cloud Platform (GCP) to Hetzner's data center in Germany. This migration was motivated by growing concerns about “trust, data protection and data sovereignty” with regard to GCP. The change brought three essential advantages:
- Cost efficiency: reduction in operating costs by over 30%
- Data sovereignty: Hosting in Germany ensured the complete compliance with EU regulations, especially the GDPR
- Performance: better hardware and network infrastructure
Practical steps to obtain real data sovereignty
In order to achieve real data sovereignty, companies should consider the following steps:
- Identify cloud providers: Check whether your current cloud provider is a US company or falls under US legislation.
- Perform risk assessment: Rate which data is particularly in need of protection and what risks you could be exposed to with US providers.
- Evaluate alternative providers: Check European cloud providers such as Ionos or Hetzner as alternatives that ensure complete GDPR conformity.
- Develop migration strategy: Plan the gradual migration of critical data and applications to European providers.
- Implement data protection measures: Implement additional safety measures such as encryption and strict access controls.
More about it here:
Sovereignty instead of dependency
The mere storage of data on servers in Germany is not sufficient to ensure real data sovereignty. The legal structure and origin of the cloud provider is crucial for the effective protection of sensitive company data.
In view of the ongoing legal uncertainties and the fundamental conflict between US law and European data protection law, migration to European cloud providers is the safest way for many companies to gain real control over their data. This decision may be associated with effort, but offers the most reliable basis for data protection and digital sovereignty in the long term.
Instead of waiting for further legal developments or the next “Schrems” judgment, companies should act proactively and regain control of their digital infrastructure. This is the only way to achieve real data sovereignty - beyond mere “paper security” through supposedly safe server locations.
Suitable for:
Your global marketing and business development partner
☑️ Our business language is English or German
☑️ NEW: Correspondence in your national language!
Konrad Wolfenstein
I would be happy to serve you and my team as a personal advisor.
You can contact me by filling out the contact form or simply call me on +49 89 89 674 804 (Munich) . My email address is: wolfenstein ∂ xpert.digital
I'm looking forward to our joint project.
