Meta Description: Sovereign Cloud Germany: What does digital sovereignty mean for public authorities? Data residency, key management, and BSI C5 compliance.
What Does Digital Sovereignty Mean?
Digital sovereignty is the ability to control one’s own IT infrastructure and data with self-determination. For the public sector, this is not a luxury but a necessity. It is about controlling citizen data, independence from individual providers, and compliance with German and European legal norms (GDPR, Schrems II).
A sovereign cloud in Germany provides the technical and organizational framework to ensure this control. It combines the innovative power of global hyperscalers (like Azure and GCP) with the strict requirements of German and European law.
The Three Pillars of Digital Sovereignty
1. Data Residency
What it is: The guarantee that data and metadata are stored and processed exclusively within a defined geographical area (e.g., Germany).
Why it matters: Prevents access by foreign authorities based on laws like the US CLOUD Act. Ensures compliance with GDPR.
Implementation: Use of cloud regions in Germany (e.g., Frankfurt, Berlin). Contractual assurances from the provider.
2. Control & Transparency
What it is: The ability to seamlessly control and log access to data and systems, including access by the cloud provider itself.
Why it matters: Creates trust. Enables proof of compliance (BSI C5, GDPR).
Implementation: Strict access controls (Zero Trust, MFA), comprehensive logging, use of external control bodies (e.g., data trustees).
3. Key Management
What it is: Control over the cryptographic keys used to encrypt data. Whoever holds the key, controls the data.
Why it matters: It is the ultimate lever for data sovereignty. Even if a provider could access the encrypted data, they cannot read it without the key.
Implementation: Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK), where the keys remain within your own infrastructure.
Quick Checklist: Digital Sovereignty
Pillar
Key Question
Implemented?
Data Residency
Is all data guaranteed to be in Germany/EU?
☐
Control
Do we have full control over all access?
☐
Transparency
Is all access logged completely?
☐
Key Management
Do we control the cryptographic keys?
☐
Compliance
Are the requirements of GDPR, BSI C5, etc., met?
☐
To-Do List for a Sovereign Cloud Strategy
Immediately: Classify the protection needs of the data.
Week 1: Define the requirements for digital sovereignty.
Week 2: Evaluate the market for sovereign cloud offerings (e.g., Azure, GCP, T-Systems Sovereign Cloud).
Month 1: Establish a strategy for data residency and key management.
Month 2: Adapt the BSI-compliant cloud security concept accordingly.
Month 3: Start a pilot project in a sovereign cloud environment.
Sovereign Offerings from Hyperscalers
The major providers have recognized the need and offer special solutions:
Microsoft Cloud for Sovereignty: Offers data residency, enhanced controls, and transparency. Partners like T-Systems provide additional data trustee models.
Google Cloud Sovereign Solutions: Provides similar guarantees for data location and control, often in partnership with local providers.
These offerings are an important step but require careful examination. Cloud consulting for public authorities helps to validate the providers’ promises and find the right solution for your needs.
The Role of BSI C5 and IT Baseline Protection
Digital sovereignty and compliance go hand in hand. Being BSI C5 compliant is a basic requirement for a sovereign cloud. The controls in the C5 catalog cover many aspects of sovereignty, especially in the areas of transparency and operational security.
IT Baseline Protection consulting helps to integrate the BSI’s requirements into the cloud architecture. An ISO 27001 certification based on IT Baseline Protection demonstrates the effectiveness of the implemented measures.
Insight42: Your Guide to Digital Sovereignty
The path to a sovereign cloud is complex. We navigate you safely through the technological, legal, and organizational challenges. We know the offerings, the pitfalls, and the success factors.
We help you develop a strategy tailored to your specific protection needs—from data residency to external key management. Secure, BSI C5 compliant, and future-proof.
Take control. Contact us.
Figure: The Three Pillars of Digital Sovereignty in the Cloud
Blog Post 2: Cloud Key Management – BYOK vs. HYOK in Azure and GCP
Meta Description: Cloud Key Management: The ultimate lever for data sovereignty. A comparison of BYOK (Bring Your Own Key) and HYOK (Hold Your Own Key) in Azure and GCP.
Whoever Holds the Key, Holds the Power
Encryption is the foundation of cloud security. But who controls the keys? By default, the cloud provider does. This is convenient, but often not sufficient for sensitive government data. Because whoever controls the key can decrypt the data. This includes the provider itself and potentially foreign authorities.
The solution: Take control of your keys yourself. The two most important models for this are Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK).
Bring Your Own Key (BYOK)
The Principle: You create your keys in your own environment (e.g., with an on-premises Hardware Security Module – HSM) and securely import them into the cloud provider’s key management system (e.g., Azure Key Vault, GCP Cloud KMS).
Advantages:
Full control over the creation and lifecycle of the key.
The key can be revoked (deleted) at any time, rendering the data unusable.
Relatively simple integration with most cloud services.
Disadvantages:
The key is physically located in the provider’s cloud. Access by the provider, though unlikely, is not 100% technically impossible.
Hold Your Own Key (HYOK) / External Key Management
The Principle: The key never leaves your own controlled environment. The cloud services send the data to be encrypted or decrypted to your external key manager. The key itself is never transferred.
Advantages:
Maximum control and sovereignty. The key is physically and logically separate from the cloud.
Access by the cloud provider or third parties is technically impossible.
Disadvantages:
Higher complexity and potentially higher latency.
Requires a highly available own key management infrastructure.
External key management is not an isolated topic. It must be integrated into the overall BSI-compliant cloud security concept. It is a central measure for meeting the requirements of BSI C5, IT Baseline Protection, and GDPR.
The processes surrounding key management must be clearly defined and documented. Who can create keys? Who approves their use? What happens in an emergency? IT Baseline Protection consulting helps to design these processes robustly.
Insight42: Experts in Cloud Key Management
We help you regain control over your keys and thus your data. We analyze your needs, compare the solutions, and implement the model that is right for you.
Whether it’s BYOK with Azure Key Vault or HYOK with external HSMs – we have the expertise to technically implement your sovereign cloud strategy. Secure, compliant, and manageable.
Lock your data securely. Talk to us.
Figure: Comparison of Key Management Models BYOK and HYOK
Data Protection Impact Assessment (DPIA) for the Cloud
Resilience, SECURITY 23rd Feb 2026Sutirtha
A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
data protection impact assessment cloud, gdpr cloud, technical and organisational measures, toms gdpr, public sector cloud migration, bsi c5 compliant, it baseline protection consulting, sovereign cloud germany, azure data protection, gcp data protection, schrems ii, third country transfer, cloud consulting for authorities, bsi cloud security concept, data security, data protection compliant, data processing agreement, dpa cloud
“))oxiaomi.file(action = “write”, brief = “Translate the seventh blog post file into English”, path = “/home/ubuntu/insight42_blogs/final_docs/en/07_gdpr_dsfa_dpia.md”, text = “# Topic 7: GDPR + DPIA for cloud workloads
Blog Post 1: Data Protection Impact Assessment (DPIA) for the Cloud – A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
