Digital Sovereignty for the Public Sector

Government agencies, municipalities, and public institutions process particularly sensitive data – from citizen records and health information to security-relevant documents. Yet many of these systems run on software and cloud services from American providers. The US Cloud Act allows American authorities to access this data, regardless of where the servers are physically located. For the public sector, this represents an unacceptable risk.

The GDPR sets clear requirements for the protection of personal data. Since the Schrems II ruling by the European Court of Justice, transferring personal data to the US has become legally problematic. Data protection authorities in Germany and Austria have repeatedly pointed out that the use of US cloud services in the public sector must be critically evaluated. Additionally, the NIS2 directive imposes stricter cybersecurity requirements on operators of critical infrastructure – including public administrations.

At the political level, pressure for digital sovereignty is growing. The European Commission actively promotes the use of open source software in public administration. Individual German states like Schleswig-Holstein and Thuringia are already sending political signals for the transition. In Austria, the Court of Audit demands greater independence from individual software vendors. The question is no longer whether, but when and how the transition will be made.

We support public institutions in making this transition in a structured and legally compliant manner – without jeopardizing ongoing operations and with a clear roadmap for every phase of the migration.