Gartner Barcelona 2026-serie: Hitachi
Digital sovereignty: how much control do you really have?
On Monday 9 November, Protinus IT is organising a private dinner for clients, partners and IT decision-makers during the Gartner IT Symposium/Xpo in Barcelona. In light of this symposium, we have asked three leading partners – Hitachi, Fsas Technologies and ESET – to share their views on the issue of sovereignty. We speak to Bastiaan van Amstel, Head of Corporate Communications EMEA at Hitachi Vantara, about digital autonomy, sovereignty and the choices organisations face.
Organisations are digitising at a rapid pace, but how much control do they actually retain over their own digital infrastructure? Now that the cloud, AI and cybersecurity are becoming increasingly intertwined with geopolitics and regulation, digital sovereignty has become a strategic issue for the boardroom. But digital autonomy does not mean you have to do everything yourself or rule out foreign technology. The key is to make conscious choices about who you depend on, which risks you accept and how much control you retain over your critical data and business processes.
According to Van Amstel, it starts with understanding your dependencies. “You don’t have to rule out every dependency, but you do need to know where you are vulnerable. The question is not how much autonomy you can achieve in the long run, but where you actually need it. For business-critical applications, availability, security and the ability to continue functioning independently are essential.”
Sovereignty goes beyond where your data is stored
Digital sovereignty has become a widely used term, but the underlying concept is anything but a passing fad. Organisations are becoming increasingly dependent on digital infrastructure, whilst geopolitical developments and regulations such as DORA and NIS2 are heightening the focus on resilience, accountability and risk management. The European Data Protection Regulation also emphasises the importance of transparency regarding the conditions under which organisations use their data and can switch providers.
In this context, sovereignty is about more than just the location of your data. It is also about who has access, which legislation applies and how dependent you are on a specific provider.
The US CLOUD Act makes it clear why this distinction matters. Storing data in a European data centre does not automatically mean that only European legislation applies. Legal control over the provider also plays a role. Under certain conditions, US authorities can request data from US providers, even when that data is stored in Europe.
Organisations must therefore look beyond the physical location of their data. Who has access? Under what legal conditions? What safeguards does the provider offer? And what happens if the geopolitical situation changes or a supplier no longer meets expectations?
For Hitachi Vantara, digital sovereignty revolves around three interrelated elements: resilience, security and legal clarity. The aim is not to eliminate dependencies entirely, but to ensure that organisations understand their risks and can continue to protect their critical data and processes.
The CIO of 2027: more than just technology
The CIO of 2027 will not be judged solely on performance, costs and innovation. The extent to which the organisation retains control over its digital foundation will also be a decisive factor.
Where is the critical data stored? Who has access to it? How well is the organisation prepared for disruptions? And how much freedom does it retain to switch suppliers or technologies?
These are not questions that IT alone can answer. They touch on the continuity and agility of the entire organisation and therefore belong at the boardroom table.
The challenge is to treat infrastructure, security and legal control not as separate issues, but as components of a single strategy. Infrastructure must not only perform well today, but also be resilient to disruptions. Security must be an integral part of day-to-day operations. And organisations must understand the legal and operational dependencies associated with their technology partners.
This requires close collaboration between IT, security, legal affairs, risk management and procurement. Only in this way can a complete picture be formed of the risks and the choices available to an organisation.
Strategic freedom of choice is the true yardstick
Digital sovereignty does not mean you have to rule out all dependencies. It means you decide for yourself which dependencies align with your strategy and which risks you are prepared to accept.
The real test is not whether your infrastructure is functioning well today, but whether you will still have choices tomorrow. Can you protect your critical processes, respond to changes and adjust your course when necessary?
For CIOs and their technology partners, this presents an important shared responsibility: helping organisations to look not only at today’s technology, but also at the flexibility, risks and dependencies that their choices create in the longer term.
After all, digital sovereignty is ultimately not about independence from technology partners, but about the freedom to continue making your own choices.
Protinus IT will be present in Barcelona to discuss this topic in more detail and, above all, to explain what we can do for you in collaboration with our knowledge partners.
Would you like to attend the dinner on 9 November, arrange a meeting or receive further information? Please contact Victor Barendsma at Protinus IT.