Who’s Really in Control of Your Cloud Data?

Recent news has brought cloud services to the forefront of public discussion in Finland. At the core of the debate is: Where will critical Finnish data be located in the future, and under which laws will it be governed?

Public services are already running on non-European clouds

According to a recent analysis cited by HS Visio, research conducted by Aalto University shows that 64 percent of digital public services provided by Finnish authorities currently run on infrastructure operated by U.S.-based companies.

Another report by Helsingin Sanomat highlights the scale of this dependency from a financial perspective. In 2024 alone, Finnish public authorities signed agreements for Microsoft licences and usage rights worth €1.17 billion. This has raised a legitimate question: are alternatives being sufficiently assessed when public procurement is so heavily concentrated on U.S. providers?

Cloud choices for sensitive public data

Two case examples show how cloud decisions now reach into the most sensitive layers of public trust.

Finnish election data is, for the first time, moving outside Finland’s borders. Candidate and voter data, as well as vote counting, will run on AWS’s public cloud infrastructure. The decision is driven by cost efficiency. This is a reasonable objective, as public authorities must use taxpayer money responsibly and cloud services offer flexibility and scalability that traditional solutions cannot. At the same time, this marks a significant shift: the core data of Finnish elections is now processed on infrastructure operated by a foreign provider.

A similar development is underway in health data. As Kela modernises its information systems, sensitive health data of Finnish citizens is moving to cloud services and may be processed across different parts of the EU. While EU-based solutions operate under European legislation and are often appropriate, for highly sensitive data such as health information, data location can remain a critical risk factor, particularly when processing extends beyond national borders.

Jurisdiction matters

In cloud decisions, the question is not only where data is physically stored, but which jurisdiction applies to it.

When the provider is a U.S. headquartered company, their European subsidiary can be compelled to comply with U.S. legislation. This includes the U.S. CLOUD Act and the Foreign Intelligence Surveillance Act (FISA), which allows U.S. authorities, under certain conditions, to request access to data, even when that data is stored in Europe. This does not mean automatic or continuous access. But it does mean that control does not rest exclusively within European jurisdiction. For public administration and systems that are critical to society, this distinction matters.

Learn more about this topic on our blog.

Domestic alternatives do exist

Alongside U.S. hyperscalers, there are European and domestic cloud providers that allow customers to decide where their data is stored. With UpCloud, customers can choose to keep their data entirely in Finland, in Finnish data centres and under Finnish law.

This is not about confrontation, nor about claiming that one model is always the right one. It is about choice and transparency. And it is about risk management, which should be on top of the agenda in board meetings. Cloud decisions should be evaluated not only through cost, but also through sovereignty, trust, and long-term governance. This means that many companies and organizations should rethink their cloud strategy.

Cloud is the future. The question is who controls that future, and on what terms.

Let’s talk about your sovereign cloud strategy.