How to Navigate Data Sovereignty in a Shifting Market

For the last decade, the contact centre market has assumed that legacy on-premise and private cloud solutions would naturally evolve into multi-tenant cloud offerings. However, that assumption is now being challenged.

To help you better understand why, we asked industry analyst Chris Marron to shed light on how recent geopolitical shifts have prompted a significant re-evaluation of cloud deployment strategies, as well as the questions you need to ask to get the very best from your chosen vendor.

There Is a Growing Call to Curtail the US’s Control Over the Cloud

Increasingly prevalent across Europe, “no US cloud” mandates reflect a rising sentiment against US-based cloud providers.

This stance isn’t entirely new, but the intensity and scope have significantly increased, especially as similar sentiments begin to emerge in Canada and elsewhere.

Where this criticism was previously limited to the most data and privacy sensitive within an organization, other governments are now leading the charge in openly expressing concerns about potential US government access to data.

There is a growing view that it is not acceptable to have the US own a country’s digital economy, and that action must be taken to curtail the US’s control over the cloud.

Additionally, diminished trust in cloud vendors themselves has emerged as a critical issue. This goes beyond concerns that a vendor might be “too far over their skis”.

Organizations now question how vendors handle data and who might gain secondary access through legislation, partnerships or third-party agreements. These concerns are now central to many purchasing decisions.

Many Perceive Private, Single-Instance Solutions as Inherently Safer

Security considerations further drive the shift toward private clouds or hybrid solutions.

Despite extensive security measures from major cloud providers, many organizations perceive private, single-instance solutions hosted within their data centres as inherently safer.

This perception also supports occasional decisions to retain fully on-premises systems. A significant portion of customers want to be able to isolate their systems within their own infrastructure and limit the access those systems have to the outside world, to reduce the overall risk profile.

A Dimension of Geopolitical Retaliation Has Entered the Conversation

Beyond security and data governance, a dimension of geopolitical retaliation has entered the conversation. In regions such as Canada and Europe, there’s a sense that the US has betrayed allied trust, spurring deliberate efforts to curtail reliance on US-based cloud providers.

Non-US vendors quickly leverage this dynamic, emphasizing both real and perceived vulnerabilities of US-centric solutions in their messaging, and positioning their alternatives as secure and sovereign.

For purely cloud-native vendors, the transition to supporting single-instance private clouds has proven smoother than the historical challenge traditional vendors faced migrating to multi-tenant models.

This agility provides a distinct competitive advantage, enabling rapid responsiveness to changing customer preferences.

Buyers Are Now Scrutinizing Vendor Claims More Rigorously Than Before

These deployment shifts are revitalizing broader discussions around trust. Buyers have become notably sceptical, scrutinizing vendor claims about security and data governance more rigorously than before.

Assurances from providers, once accepted more readily, now meet greater scepticism, prompting deeper, more critical evaluations by organizations too.

Vendors are actively responding to these demands, reshaping their offerings to accommodate evolving preferences around data sovereignty and deployment flexibility.

Buyers, in turn, must thoroughly assess the security and trust implications of their choices. Deciding whom to trust with deployment, data management, and overall security is no longer an afterthought, it has become a pivotal factor in purchasing decisions.

Ultimately, the debate is not around the deployment model, it’s about the effects of the deployment model. Customers care what the deployment model means for them.

After all, the success of the cloud is driven by its ability to drive regular innovation, its ability to share resources across a broad customer base, its elasticity to scale, and its lower ops burden.

Current architectures, technologies and development methodologies allow vendors to deliver improvements faster than ever before, to all deployment types.

Limitations to access complicate, but do not prevent, the process of updating and adopting new features for premises and private cloud deployments.

Customers Must Go Into the Sales Process With Their Eyes Wide Open

Cloud solutions remain the simplest and, often, the default solution.

However, it is critical when evaluating new solutions that customers fully identify their exact needs before engaging with vendors.

This is because the best sales processes are collaborative, with the vendor understanding the customer’s problem set, and explaining how they can solve it. It’s a win–win!

Beyond this, it’s important for customers to ask the following questions to know exactly what they are getting from their chosen provider before they sign up:

1. What Regulations Are They Currently Bound By, and What Regulations Might They Be Bound By Over the Lifetime of the Solution They’re Buying?

Current legislative restrictions are not enough. AI, and data legislation is rapidly evolving in multiple countries globally, and regulations vary by industry and function.

Consider carefully how changes in legislation might impact your solution going forward. Any change in solution is an expensive process.

2. Where Must the Data Reside, and What Restrictions Are Placed Around That?

This may vary across operations in different geographies. Make sure any provider can meet all of your needs.

3. Which Governments, Companies, and Third Parties Have Access to the Data?

Modern tech solutions use a slew of services to deliver the overall solution. LLMs, transcription, background noise suppression – there are lots of licensed third-party technologies that can sneak into the mix.

Depending on where a company operates and is headquartered, multiple sets of legislation can influence who has the right to access your data. If you, and not the vendor, hold the encryption keys, and only you have administrative access, then the risk is reduced.

4. What IT Burden Does Your Choice Place on You?

If you own the solution, you have to manage, secure and maintain it.

Hyperscalers do have extremely extensive security functions, infrastructure teams, and support functions.

5. Does This Solution Meet My Full List of Requirements?

Last but not least, remember that data sovereignty and security are not the only factors you need to evaluate.

The goal here is to completely and fully evaluate all the risks and benefits of a solution, to make sure that you’re getting the best possible result for your business.

Rigorous Vendor Evaluation Will Keep You Agile as Laws, Risks and Technologies Evolve

In practice, the pendulum isn’t swinging back to the past so much as widening the set of viable choices.

The winners will be the organizations that translate sovereignty and security requirements into concrete contractual controls, insist on visibility into sub-processors and key management, and plan for future needs.

Whether you land on multi-tenant, private cloud, hybrid, or on-premise, clarity on requirements and a rigorous vendor evaluation will keep you agile as laws, risks and technologies evolve.

Disclaimer: This article is not legal advice; please always validate requirements with counsel.

Written by: Chris Marron, an independent communications-industry analyst

For more information on contact centre technology, read these articles next:

• 10 New Ways Tech Is Helping Agents Right Now
• What Are Intelligent Contact Centres Doing Right Now?
• Can AI Really Handle Customer Complaints?

Author: Chris Marron
Reviewed by: Megan Jones