Why some organisations care, and why others don't.

The case made for it

• A provider under US jurisdiction can be required to hand over data it controls, even when that data is stored in a UK data centre. Storing data in the UK doesn't, on its own, change that.
• Because these laws apply to a provider based on where it is headquartered, not where the data sits, some organisations treat this as a risk to manage whatever an individual provider's track record.
• Some orders legally prevent the provider from telling the customer that their data was requested.
• US law in this area changes, and those changes are decided outside the UK. Some organisations would rather not carry that uncertainty for their most sensitive data.
• Providers that are headquartered outside the US, or run by a separate local company, aren't subject to US orders in the same way.

The counterpoints

• Requests for business customers' data held abroad are rare. The large providers publish transparency reports, and these show very few, and in some reporting periods no, disclosures of enterprise customers' content stored outside the US.
• The UK and US have a Data Access Agreement, in force since October 2022 and since renewed. Neither country can use it to target people in the other. Because the UK is a partner, a provider can also ask a US court to set aside a CLOUD Act warrant for a non-US person's data if complying would break UK law.
• If you hold the encryption keys yourself, outside the provider's control, anything the provider handed over would be unreadable without them. AWS, Microsoft and Google all offer ways to keep keys in your own hardware or with a third party. The US Department of Justice says the CLOUD Act creates no new power to force a provider to decrypt data.
• Confidential computing adds protection while data is being processed, inside isolated, tamper-resistant hardware that the provider's staff can't see into.
• Most countries, the UK included, have laws that let their authorities require data from providers under their jurisdiction. The UK's Investigatory Powers Act 2016 is one. Changing provider changes which laws apply. It doesn't remove the question.

The case made for it

• A small number of providers run a large share of the UK's services. The CMA's 2025 market investigation found that two providers hold most of the UK cloud market.
• Outages at that scale spread widely. In October 2025, two separate faults at major public clouds each disrupted many services worldwide, including in the UK, for several hours.
• Some global features depend on systems in another country, even when your own workloads run in a UK region.
• Spreading work across more than one provider, or keeping some in-house, can limit how much any single failure affects you.
• Moving away from a large provider can be slow and costly, because of data transfer charges and services that exist on only one platform. That makes it harder to respond if terms change.

The counterpoints

• The largest providers invest heavily in resilience: several separate data centres in each region (called availability zones), many regions, and large security teams. Few organisations can match that in-house.
• Smaller providers fail too. In 2021 a fire destroyed a European provider's data centre and some customers lost data. In 2022 a UK provider serving many public bodies went into liquidation, and its customers had to migrate.
• Regulators now oversee the largest providers directly. Since July 2026, the services AWS, Google Cloud, Microsoft and Oracle provide to UK finance have been under joint oversight by the Bank of England, the PRA and the FCA.
• Most outages can be designed around within one provider, using several zones or regions. Running on two providers brings cost and complexity of its own.
• Leaving is getting easier. In March 2026 the CMA said it was checking that AWS and Microsoft deliver steps they announced to support customer choice. In the EU, switching charges are banned from January 2027.

The case made for it

• Financial firms must keep important business services within set limits of disruption, called impact tolerances, even when a supplier fails. These FCA and PRA rules have applied in full since 31 March 2025. Some firms find this easier to show for a provider they could leave quickly, or for services they run themselves.
• UK GDPR controls transfers of personal data outside the UK, and remote access from abroad can count as a transfer. Keeping the data, and the people who can access it, in the UK means there's no international transfer to assess.
• Transfers to the US often rely on the UK–US data bridge, in force since October 2023. It's linked to the EU–US Data Privacy Framework, which faces a legal challenge in the EU. Some organisations prefer not to depend on it.
• Some defence, national security and government work has its own handling rules. Information above OFFICIAL in the Government Security Classifications, or contracts with specific terms, may need particular hosting and security-cleared staff.
• Customer and government contracts sometimes require UK hosting or UK-based support, whatever the law says.

The counterpoints

• UK regulators don't pick providers. The FCA, the PRA, the ICO and the National Cyber Security Centre (NCSC) set outcomes and principles, not a list of approved or banned clouds.
• Most public sector information is classified OFFICIAL, and public cloud services, including those of the largest providers, are widely used for it.
• NHS guidance allows health and care data, including confidential patient information, to be hosted in the UK, the European Economic Area or a country the UK considers adequate, subject to the organisation's own risk assessment.
• There are lawful routes for international transfers: the UK–US data bridge, the UK's other adequacy regulations, and standard contract terms such as the International Data Transfer Agreement (IDTA). Since 5 February 2026 the test is whether protection abroad is “not materially lower” than in the UK.
• Operational resilience rules can be met on public cloud with good design and a tested exit plan. The rules ask for the plan, not for a particular kind of provider.

The case made for it

• For steady, predictable workloads, some organisations find that a smaller provider, or their own hardware, costs less over several years than pay-as-you-go public cloud.
• Building on open, portable tools rather than one provider's own services makes moving easier later, and gives you more room to negotiate.
• Sovereign options are growing quickly. AWS, Microsoft and Google all launched or extended sovereign offerings in 2025 and 2026, and European providers are adding managed Kubernetes, databases and AI services.
• Running more of the stack yourself builds skills in your own team, which helps whichever way you go later.
• Choosing from more providers gives you more negotiating power and more options if one changes its terms.

The counterpoints

• The largest providers offer hundreds of managed services. Smaller providers offer fewer, so your team may need to build and run more itself.
• Sovereign versions often cost more, and can launch with fewer services than the standard public regions. Check the service list for the exact offering, not the provider as a whole.
• Many UK engineers know AWS or Azure well. Fewer have run a European provider's platform or a private cloud at scale, so hiring and training can cost more.
• Running your own hardware means buying ahead of demand, paying for spare capacity and a second site, and replacing kit every few years.
• Running two platforms during a migration, or limiting yourself to features every platform shares so you can move, both add cost.

The case made for it

• Prompts and documents sent to an AI model often contain some of the most sensitive data you hold. Where the model runs matters as much as where the data is stored.
• Open-weight models can run entirely on your own hardware or a sovereign provider, with nothing leaving your control. For tasks such as summarising, classifying and searching documents, they're often good enough.
• Some AI services route requests to other regions or countries to find capacity. A sovereign set-up makes it simpler to show where processing happened.
• Sovereign providers now offer AI. IONOS's AI Model Hub serves open-weight models from German data centres, and since September 2026 the AWS European Sovereign Cloud has offered Google's open-weight Gemma 4 models.
• When you run the model yourself, you decide when it changes. A provider can't retire or alter a model your process depends on.

The counterpoints

• The most capable models are usually only available as a service from their makers and through certain clouds. If a task needs the best model available, that may decide where it runs.
• Running open-weight models yourself needs graphics processors (GPUs), which are expensive, and people who can run, secure and evaluate the models.
• The large providers offer contractual commitments on AI data, such as not using your prompts to train models, and options to keep processing in a region. Google, for example, offers local processing for selected Gemini models in the UK.
• Frontier models are reaching private settings too. Since August 2025, Google has offered Gemini on Google Distributed Cloud air-gapped, which runs in the customer's own data centre with no internet connection.
• Open-weight models still come from a handful of companies, many outside the UK. Running them yourself changes who operates the model, not who made it.