Digital Sovereignty in Local Government — What It Really Means

“Digital sovereignty” now appears in almost every digital strategy of the federal government, states, and municipalities. In practice, however, the term often remains vague — and is frequently equated with “GDPR-compliant.” This is too narrow. Sovereignty is not about whether data processing is permitted, but who actually controls the data: Who can view it, who can shut down the service, who determines pricing and feature scope, and how can a municipality exit the arrangement. For the roughly 1.6 million employees in German municipalities (Federal Statistical Office, Public Sector Employees 2024), these are not abstract questions — they determine which tools can even be used in town halls, construction yards, and field services. This article clarifies the concept and makes it actionable.

What does digital sovereignty mean for a municipality?

Digital sovereignty means the municipality retains control over its data, systems, and operational capability — even when providers, prices, or political conditions change.

The concept has three layers that often overlap in practice. First, the data layer: Where are the data stored, under which legal jurisdiction do they fall, and who has technical access. Second, the technology layer: How dependent is the administration on a single provider, its roadmap, and pricing. Third, the operational layer: Can the municipality still fulfill its tasks if a service fails, becomes more expensive, or is no longer available for political reasons?

For an administration, this does not mean doing everything in-house. Sovereignty is not autarky, but freedom of choice: the ability to consciously decide which dependencies to accept — and to reverse that decision later without losing data or processes. It is this reversibility that distinguishes a sovereign procurement from one that is merely formally compliant with data protection.

Why is “GDPR-compliant” no longer sufficient as a criterion?

Because the GDPR regulates whether processing is legally permissible — not who can actually access the data in an emergency.

A service can fully meet data processing agreements, records of processing activities, and standard contractual clauses and still operate within a structure where the municipality has no real control. Data protection compliance is a minimum requirement, not a differentiator — every serious provider meets it.

Sovereignty goes deeper and asks about actual control: Who owns the provider? Under which law does the parent company operate? Which subcontractors are involved, and where are they based? Can the provider’s administrators technically access content? What happens to the data when the contract ends? These questions are not answered in a privacy notice — they belong in vendor assessments and tenders. If you only ask for “GDPR compliance,” every bidder will say yes, and you gain no criteria at all.

What role does the US CLOUD Act play?

The CLOUD Act obliges US providers to grant US authorities access to data — regardless of where the data are stored.

The Clarifying Lawful Overseas Use of Data Act of 2018 is at the heart of the problem that cannot be solved by European hosting alone. It applies to companies subject to US law — including European subsidiaries of US corporations. A data center in Frankfurt changes nothing if the parent company is in the US.

Add to this the unstable legal situation for data transfers: The European Court of Justice invalidated the Privacy Shield in the Schrems II ruling (Case C-311/18, July 2020). Its successor, the EU-US Data Privacy Framework, has been under legal scrutiny since its entry into force. For a municipality, this creates planning risk: a procurement decision whose legal basis depends on a single adequacy decision can be called into question by a court within months. A provider fully subject to European law structurally avoids this risk.

How do you recognize a sovereign platform?

By four verifiable points: where the data are stored, who owns the operator, which AI models run in the background — and how you can exit.

These four questions can be asked of any provider and answered in writing:

1. Hosting and legal jurisdiction. In which country are the servers located, who operates the data center, are there replicas or backups outside the EU? A specific data center operator is a reliable answer; “in the EU” alone is not.
2. Ownership structure of the operator. Who owns the company, under which law does it operate, are there US parent companies or investors with control rights?
3. AI components. More and more platforms integrate language models. What matters is which models these are and where they are operated — otherwise content leaves the legal jurisdiction you just secured through hosting.
4. Exit capability. What data can you get out in which formats, how long does an export take, and what happens to the data after the contract ends? Without solid answers, any sovereignty claim is just a snapshot.

How do you bring sovereignty into procurement?

By formulating it as verifiable criteria rather than a statement of intent — and demanding evidence, not self-declarations.

The most common mistake in tenders is wording like “The provider must be GDPR-compliant.” Every bidder will agree, leaving the contracting authority with no differentiation. Verifiable criteria look different: naming the data center operator and location, listing all subcontractors with their countries of residence, specifying the AI models used and where they are operated, describing data export with formats and deadlines, disclosing the provider’s ownership structure.

It also makes sense to treat sovereignty not only as an exclusion criterion but as a weighted award criterion. Then providers compete not only on price but also on how robustly they can answer these questions. And the practical side effect: once you have the answers in writing, you can share them directly with the works council, data protection officer, and IT security officer — three bodies that will ask these questions anyway.

Where should municipalities start in practice?

Best where the biggest gap exists today — usually in internal communication for operational teams.

Switching to sovereign solutions is often seen as a major project: office suite, email, specialist procedures, all at once. That is the surest way to achieve nothing. More realistic is a defined area with high pain points and low migration effort. In many municipalities, this is internal communication for construction yards, daycare centers, fire departments, and field services — coordination today often happens via private messenger groups, i.e., a solution that is neither official nor sovereign. How to replace this is described in Official communication instead of private WhatsApp; the bigger picture is outlined in German alternative to Microsoft Teams & Office.

Kibi Connect addresses this directly: the platform is developed by Weslink GmbH in Coesfeld and operated exclusively in German data centers (Hetzner); integrated AI functions run on European models hosted in the EU. This covers an area affecting over 40% of employees — without having to touch the entire IT landscape.

Checklist for vendor selection

• Data center location and operator named explicitly — not just “EU”
• Provider’s ownership structure disclosed, no control rights from third countries
• Complete list of subcontractors including country of residence
• AI models used specified, operated within the EU
• Data export in standard formats guaranteed, with deadlines and scope
• Deletion concept after contract end documented in writing
• Data processing agreement, role and rights concept, SSO integration available
• Sovereignty criteria included as weighted award criteria in the tender

Conclusion: Sovereignty is about control, not server location

A German data center is a necessary but not sufficient condition — what matters is who actually controls the data and the service. For municipalities, this means expanding vendor assessments to four questions: legal jurisdiction, ownership structure, AI components, and exit capability. If you include these points in the tender and demand evidence, you make a decision that will still hold after the next ruling by the European Court of Justice. And if you start small — with internal communication for operational teams — you get quick results instead of waiting for a major project.

To learn how administration, construction yards, and field services can collaborate on a single platform, read Employee platform for municipalities.

Try for free now | Book a demo | View pricing