Concept card

BARC — Data Sovereignty 2026: Reality, Relevance, Roadmap

As of 2026-09-27

Edited by Cédric Mary, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is BARC?

BYOK versus HYOK is the concrete sovereignty decision inside every 2026 BDC/Datasphere architecture — with HYOK, the key never leaves the customer's environment, so even a legal compulsion order can't force plaintext access.

Data sovereignty is the operational ability of an organisation to control where its data physically resides, who can access it, under which legal jurisdiction, and which providers' infrastructure and key-management systems ever touch it — even briefly, even encrypted. For SAP analytics consultants working in Europe, the topic stopped being an abstract compliance concern years ago; every Business Data Cloud, Datasphere, or SAC architecture decision now carries a sovereignty dimension that a client's data protection officer and security leadership review before a project is even scoped, and getting it wrong late in a build is far more expensive than designing for it from the first workshop.

The gap the research addresses

The central finding this research line tracks is a persistent gap between executive intent and operational reality: leadership teams say sovereignty matters, yet most European enterprise data still concentrates on a small number of non-European hyperscalers, and the roadmap from stated intent to an actual sovereign-cloud landing zone is longer and more contractually complex than most programme plans assume. The relevance of that gap varies sharply by industry — banking, public sector, healthcare, and defence face binding regulatory obligations that push sovereignty from a preference to a hard requirement, while less regulated industries can often satisfy stakeholders with contractual guarantees alone.

Why it matters

The BYOK/HYOK distinction is precise and consequential: BYOK keys are customer-generated but provider-stored; HYOK keys never leave the customer environment, which is why HYOK gives the strongest DORA-compliance posture for banking.
Three concrete sovereign-cloud options are named for the hyperscaler-landing decision: Delos Cloud (Germany), S3NS/Bleu (France), Oracle EU Sovereign Cloud.
The DPO/CISO sign-off is framed as a gating step, not an afterthought — every BDC/Datasphere/SAC architecture decision in 2026 now carries a sovereignty dimension that must clear that review before build starts.

Key points

BARC publishes Data Sovereignty 2026 as a dedicated 'Reality, Relevance, Roadmap' study line.
Topic is operational: where data lives, who accesses it, which legal regime governs it.
For SAP: shapes hyperscaler choice, BYOK/HYOK configuration, and cross-border flow governance.
Specific findings (vendor rankings, country splits, percent-of-adopters) are paywalled — title is the verifiable artefact.
BYOK: the key is generated by the customer and stored in the provider's KMS. HYOK: the key never leaves the customer environment — the strongest posture for DORA compliance in banks.
DORA (in force since 17 January 2025): mandatory assessment of ICT third-party concentration risk. EU Data Act (September 2025): portability right for non-personal data.
Available SAP controls: Datasphere BYOK via AWS KMS / Azure Key Vault / Google Cloud KMS; SAC BYOK on private edition; BDC BYOK for Delta tables; contractual EU Access Restriction (EAR).
Mandatory sovereignty checklist before architecture: data classification, residency constraints, key-management posture, DORA concentration implications.
SAP Standard Contractual Clauses: confirm they cover the data-processing path from the EU tenant to the hyperscaler region for every Datasphere/SAC deployment.
Sovereign cloud (Delos in Germany, S3NS/Bleu in France) is available through SAP partnerships for regulated industries that require national data residency.

Terms used on this page

Data sovereignty: An organisation's operational control over where its data resides, who accesses it, and under which legal regime — distinct from data residency, which is only the physical location.
BYOK / HYOK: Bring-Your-Own-Key / Hold-Your-Own-Key — encryption-key management patterns that keep the cloud provider from being able to read tenant data without the customer's explicit cooperation.
Sovereign cloud: A hyperscaler offering operated by a regional partner under local jurisdiction — examples include Delos Cloud (Germany), S3NS / Bleu (France), Oracle EU Sovereign Cloud.
DORA: The EU's Digital Operational Resilience Act (Regulation (EU) 2022/2554), in force since 17 January 2025, mandating ICT third-party concentration-risk assessment for the financial sector — the regulatory driver behind HYOK adoption in banking.
EU Data Act: EU regulation (in force since September 2025) establishing a portability right for non-personal data and switching obligations between cloud providers — distinct from GDPR, which governs personal data.
EU Access Restriction (EAR): A contractual SAP mechanism restricting non-EU personnel access to a customer's data and metadata hosted in the EU, offered alongside technical BYOK/HYOK controls as a complementary, non-technical sovereignty layer.
Processing sovereignty (vs storage sovereignty): The distinct question of which jurisdiction's infrastructure a compute or AI-inference operation actually executes on, as opposed to where the underlying data is stored at rest — a HYOK configuration answers the storage question but not the processing question for a generative-AI-hub-routed model call.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →