Where your data physically lives matters more in 2026 than it has at any point in the last decade. Tighter UK regulation, the practical reality of the US CLOUD Act, and a steady drumbeat of ransomware against UK businesses have moved data sovereignty from a niche concern to a question your insurer, your auditor, and your larger customers are likely to be asking.
This is a guide for North West SMEs trying to work out what cloud storage and sovereignty actually mean for their business, and what to do about it.
What “sovereign cloud storage” actually means
Sovereign cloud storage is storage that keeps your data in the UK, under UK law, on infrastructure that is not subject to extraterritorial demands from a foreign government. It is a useful definition because it cuts through the marketing and identifies the three things that genuinely matter:
- Where the data is stored. Physical location of the data centre
- Who controls the company that operates it. A UK-based subsidiary of a US parent is not the same as a UK-owned operator
- Which legal framework applies. UK GDPR and the Data Protection Act 2018 should govern the data, with no overriding foreign legislation
The major hyperscalers offer UK regions and have made significant commitments to data residency. Those commitments are real but they are not the same as sovereignty. Data stored in a UK region of a US-headquartered cloud is still subject to the CLOUD Act, which can compel the parent company to disclose data regardless of where it is held.
Who actually needs sovereign cloud storage?
Not everyone. For a lot of SMEs, Microsoft 365 in a UK region with appropriate configuration is a perfectly reasonable answer. The businesses that should think more carefully are:
- Accountancy practices and IFAs holding sensitive client financial records
- Care providers handling personal and health information
- Manufacturers and engineering firms with valuable IP, drawings or production data
- Anyone working on UK government contracts where the contract specifies UK-only data handling
- Any business whose customers have started asking about data sovereignty in their procurement process
If you are in one of those categories and your data currently sits with a US-headquartered provider, it is worth a proper review.
The realistic options
Microsoft 365 with proper configuration
For email, file collaboration and day-to-day documents, Microsoft 365 hosted in the UK region is the most common starting point. With the right configuration of conditional access, multi-factor authentication, data loss prevention, and retention policies, it is a sound platform. It is not strictly sovereign, but for a large proportion of UK SMEs it meets the operational and regulatory requirements they actually have.
UK private cloud
For sensitive workloads, line-of-business applications, or data that genuinely needs to stay under UK-only control, a UK-owned and operated private cloud is the appropriate option. Data sits in UK data centres run by a UK company. There is no parent organisation in another jurisdiction to compel disclosure.
Hybrid
The practical answer for most businesses is a mix. Microsoft 365 for collaboration. Sovereign UK private cloud for the workloads that need it. The skill is knowing where to draw the line, and being able to explain that decision to an auditor or insurer.
What to do about ransomware
Whatever cloud arrangement you have, ransomware is the threat that will test it. The basics are not optional:
- Backups that are immutable, meaning they cannot be altered or deleted by an attacker who has compromised an admin account
- Backups that are tested. An untested backup is a hope, not a control
- Backups that are off-network or air-gapped from the production environment
- A documented recovery time, agreed with the business, and verified through actual recovery tests
For Microsoft 365 specifically, the platform’s built-in retention is not a backup. Anything important needs a third-party Microsoft 365 backup product, ideally with data held in UK data centres.
Cost considerations
The cost story for cloud storage has shifted. Predictable per-user, per-month pricing on platforms like Microsoft 365 makes budgeting straightforward. The complication is egress fees on the major public clouds. Moving large volumes of data out of a hyperscaler can become expensive, which can lock a business in to a particular provider in ways the original procurement did not anticipate.
For UK private cloud, pricing is usually a flat monthly fee with no egress charges. For workloads that involve a lot of data movement, that can be the more economic option even before sovereignty enters the conversation.
How to start a review
Three practical steps:
1. Map what you have. List every place your business data is held. Microsoft 365, file shares, line-of-business applications, backups, anything held by your accountants or other third parties.
2. Identify the sensitive subset. Of everything on that list, which data would cause real harm if it were disclosed, lost, or held to ransom? That is the data that drives the sovereignty decision.
3. Review the contracts. For each provider holding sensitive data, find out where the data is stored, what jurisdiction governs it, and what the recovery position looks like if they suffer an incident.
Most businesses find that step three turns up at least one surprise.
About Blowfish Technology
Blowfish Technology is a managed IT, cloud and cyber security provider for North West UK SMEs, with offices in Ormskirk and Liverpool. We have been trading since 1999 and hold ISO 9001, ISO 27001 and Cyber Essentials Plus.
We work with Microsoft 365, Microsoft Azure, AWS, and our own privately owned UK sovereign cloud, which means we can be straight with clients about which option actually fits the workload rather than selling whichever one we have a margin on.
If you would like to talk through a cloud or sovereignty review for your business, get in touch.
Cloud sovereignty review
If you are unsure where your business data actually lives, or whether your current arrangement holds up under scrutiny, we can help you find out.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.