EU Data Sovereignty for Video Conferencing: The 2026 Guide

EU data sovereignty means keeping the personal data your video platform handles under European legal control: processed on European infrastructure, operated by an organisation answerable to EU law, with limited exposure to foreign government access orders. For video, where calls carry patient consultations, legal advice and board discussions, that control has become a procurement question as well as a technical one.

This guide defines EU data sovereignty, explains why it matters in 2026 and maps the rules that apply to real-time video. Those rules are the General Data Protection Regulation (GDPR), the US CLOUD Act, the EU-US Data Privacy Framework, the Network and Information Security Directive (NIS2), the Digital Operational Resilience Act (DORA), the EU Data Act and the EU AI Act. Each section is a short, self-contained summary that points to a deeper article where one exists.

Key points

• EU data sovereignty means data is processed on European infrastructure, operated by a company answerable to EU law and kept out of reach of foreign access orders - it goes further than data residency, which is only about where data sits.
• EU hosting alone isn't enough: under the US CLOUD Act, a provider with a US parent or cloud host can be compelled to disclose EU-stored data.
• For video, sovereignty has to cover media, recordings, transcripts, metadata, logs and any AI processing layer, not just the server location.
• Several EU rules now reach video tools: the GDPR, NIS2, DORA, the EU Data Act and the EU AI Act.
• The real test of a sovereign provider is who operates the infrastructure and under which jurisdiction - ask where data is processed, who holds the encryption keys, and whether any sub-processor sits under foreign law.

On this page

• EU rules that affect video, at a glance
• What EU data sovereignty is
• Sovereign cloud and how to prove it
• Why it matters now
• Open source and sovereignty
• The GDPR and EU hosting
• The US CLOUD Act
• The EU-US Data Privacy Framework
• NIS2
• DORA
• The EU Data Act
• Encryption and customer-held keys
• The public sector
• AI features and the EU AI Act
• The video API layer
• How Digital Samba approaches EU data sovereignty
• How to check whether a video provider is sovereign
• Frequently asked questions

EU rules that affect video, at a glance

What is EU data sovereignty?

EU data sovereignty is the principle that data connected to Europe should be governed by European law and kept out of reach of foreign jurisdiction as far as possible. It goes further than data residency: storing data in a Frankfurt data centre means little if the company operating that data centre can be served a US court order for it. Sovereignty depends on three things working together: where data is processed, who operates the infrastructure, and which legal system the operating company answers to.

These terms overlap, so it helps to separate them. Data sovereignty is the legal-control question, and a sovereign cloud is the infrastructure answer to it. Data residency is only about where data physically sits, while data localisation is a legal requirement that it stay in-country. Two wider terms sit alongside these: digital sovereignty is a region's ability to operate its technology independently, and operational sovereignty is about who runs the service day to day.

Our guide to data sovereignty for video platforms covers how these layers interact.

What is a sovereign cloud, and how do you prove it?

A sovereign cloud is infrastructure built so that the data and systems running on it stay under the control of a specific jurisdiction (here, Europe) and, as far as possible, outside the reach of foreign access laws. The test is not where the servers sit but who owns and legally controls the provider operating them. A European region rented from a US hyperscaler doesn't meet that bar; a sovereign cloud for video needs European-operated infrastructure in the media path.

Sovereignty claims can now be checked against named schemes instead of being taken on trust. The European Commission's Cloud Sovereignty Framework scores offers across eight objectives and assigns a Sovereignty Effectiveness Assurance Level from SEAL-0 to SEAL-4. SEAL-2 is the minimum in the Commission's own sovereign-cloud tender. France's SecNumCloud sets its own sovereignty requirements, while Germany's C5 is a security and transparency attestation. At EU level, the EU Cybersecurity Certification Scheme for Cloud Services (EUCS) remains unadopted, with its sovereignty requirements the main sticking point, and the Gaia-X initiative works on shared standards. The questions to ask any provider are set out in our explainer on sovereign clouds and what they mean for video conferencing.

Why does EU data sovereignty matter now?

Sovereignty has become a buying criterion because three pressures have arrived at once. First, two EU-US transfer frameworks have already been struck down by the EU's Court of Justice, and the current one is under appeal. A US-hosted tool can therefore no longer be assumed to be a stable basis for personal data.

Second, EU rules now impose binding duties on the tools organisations depend on. DORA has applied since January 2025 and the EU Data Act since September 2025, and NIS2 duties are taking effect through national law.

Third, Europe runs much of its public and private digital infrastructure on services from a small number of US-headquartered technology companies, and that concentration is itself a sovereignty risk: when critical communication depends on a provider subject to foreign law, a government access order or a policy change abroad can affect European organisations with little recourse. Reducing that dependence has become a policy priority. In June 2026 the European Commission published a Tech Sovereignty Package, including an open-source strategy and a proposed Cloud and AI Development Act, aimed squarely at Europe's reliance on a handful of non-EU providers. Our article on Europe's dependency on US software and cloud providers as a threat to its digital sovereignty examines the pattern.

How does the EU's open-source strategy relate to sovereignty?

Open source supports sovereignty by making systems auditable and reducing lock-in, but open licensing alone does not make a platform sovereign. What decides sovereignty is where the software runs and who operates it: an open-source stack hosted and controlled by a US company carries the same jurisdictional exposure as any other. The EU's 2026 open-source strategy matters most when it is paired with European operation. Our piece on what the EU's open-source strategy means for video infrastructure goes into detail.

Does the GDPR require EU data hosting?

The GDPR does not explicitly require that personal data be hosted inside the EU, but it restricts transfers of that data outside the European Economic Area (EEA) unless specific safeguards are in place. Keeping processing in Europe is generally the simplest route, because it removes the geographic transfer question. EU hosting still doesn't remove transfer issues if a non-EEA entity, such as a US-based parent or support team, can access the data. For video, that puts the focus on where media servers, recordings and transcripts are processed, and who can reach them. Our guide to whether the GDPR requires EU data hosting explains how the rules apply to video.

More on GDPR compliance in practice:

• GDPR-compliant video conferencing
• A 10-step checklist for GDPR compliance
• GDPR data breaches in video conferencing
• Ensuring compliance in video communications across borders

Why is the US CLOUD Act a risk for European data?

The US CLOUD Act lets US authorities, through a warrant or other legal process, require providers subject to US jurisdiction to disclose data in their possession, custody or control, wherever in the world it is stored. Exposure depends on a US connection, which is why EU hosting alone is not enough: if a provider, its parent company or its cloud host falls under US jurisdiction, European data can be reached through that company even when the servers are in Europe. Under Article 48 of the GDPR, a foreign court order is not on its own a valid basis for such a transfer. There is no EU-US agreement that resolves the conflict, which leaves providers caught between two legal systems. Our article on why the CLOUD Act is a threat even to businesses based in Europe explains the mechanism and who it affects.

Will the EU-US Data Privacy Framework hold?

The EU-US Data Privacy Framework is the current legal basis for transferring personal data to US companies that self-certify to it, but its long-term stability is uncertain. Its two predecessors, Safe Harbour and Privacy Shield, were both struck down by the EU's Court of Justice, the second in the 2020 Schrems II ruling that still shapes how transfers are assessed. The current framework was adopted in July 2023 and upheld by the EU General Court in September 2025, but that ruling has been appealed to the Court of Justice (Case C-703/25 P), so the question is not settled. Certified providers remain a lawful route today, but buyers should avoid building a compliance position that depends on the framework staying valid. We track the risk in will the transatlantic Data Privacy Framework hold, and look at the political pressure on it in how a Trump presidency threatens the EU-US data-transfer agreement.

How does NIS2 affect video conferencing?

NIS2 is the EU directive that raises baseline cybersecurity duties for essential and important entities in critical sectors, such as energy, health and digital infrastructure. It does not regulate video tools directly; instead it reaches them through an in-scope organisation's own risk-management and supply-chain duties. Under Article 21 of the directive, those measures include cryptography and encryption, access control, business continuity and the security of suppliers, and the same article names secured voice, video and text communications among the controls to apply where appropriate. In-scope entities also face staged incident reporting, with an early warning within 24 hours and a fuller notification within 72 hours. A buyer in scope needs to be able to show that its video provider meets these controls, ideally with evidence beyond the vendor's own word. To see what the directive asks of video tools in practice, read NIS2 and secure video communication.

How does DORA apply to video conferencing?

DORA sets operational-resilience rules for the EU financial sector and has applied since January 2025. Video conferencing used for regulated business can fall within its rules on information and communications technology (ICT) third parties. Financial entities must keep a register of information on their ICT third-party arrangements, run due diligence on suppliers, and secure contractual rights around incident assistance, continuity and exit. Direct EU oversight reaches only suppliers formally designated as critical ICT third-party providers, but every vendor is caught indirectly through the financial entity's duties under the regulation. The financial entity therefore has to document and justify its choice of video vendor. Our article on DORA and video conferencing covers what financial firms should ask a provider.

What does the EU Data Act change for video providers?

The EU Data Act has applied since September 2025. It sets rules on data access, portability and switching between data processing services, designed to stop customers being locked into a single vendor. A software or API-based video platform can fall within scope, which raises questions about how easily a customer can export their data in a usable format and move to another provider. Switching charges are being phased out, with a ban on them from 12 January 2027. Providers built on open standards and clean export paths are likely to be better placed to meet its requirements than closed platforms. The provider side is in our article on the EU Data Act and video conferencing.

Can encryption or customer-held keys make a provider sovereign?

Encryption lowers exposure but does not by itself change a provider's legal obligations. If a provider is subject to a foreign access order, strong encryption with keys held in the EEA and under the customer's control makes the data far harder to produce in readable form. The European Data Protection Board's Recommendations 01/2020, issued after Schrems II, name this as a supplementary safeguard for storage where the provider has no access to the keys, but not for features where the provider processes readable content.

End-to-end encryption takes this further by keeping keys with participants. The trade-off is that a provider can't process content it can't read, so recording, transcription or server-side AI means giving up end-to-end encryption for that call. In practice, encryption and key custody are worth having and reduce risk, while legal exposure is ultimately decided by who operates the service and under which jurisdiction.

What does sovereignty mean for the public sector?

For public bodies, sovereignty is often a formal procurement requirement, not a preference, tied to regulations, certification schemes and tender criteria. Video conferencing for government has to account for where recordings and transcripts are stored, who can be compelled to disclose them, and how a vendor proves its controls during a tender, increasingly against named benchmarks such as the Commission's Cloud Sovereignty Framework and its SEAL assurance levels, or national schemes like SecNumCloud. A clear checklist makes those requirements easier to write into tender language, and our procurement guide to sovereign video conferencing for the public sector walks through one.

How does AI change the sovereignty picture for video?

AI features add a second processing layer: transcription, summaries and captions send audio to a model, so sovereignty can be lost at the AI layer even when the call itself is EU-hosted. The question to ask is where that processing happens and whether any of it leaves European control. The GDPR applies to the personal data in these features, and the EU AI Act may apply too, depending on what the feature does. For example, emotion recognition in the workplace or education has been prohibited under Article 5(1)(f) since 2 February 2025, with narrow medical and safety exceptions. Our article on building AI into video without breaking EU law covers the regulatory side, and sovereign AI in Europe gives the wider context.

How do you secure the video API layer?

Secure the video API layer by authenticating sessions with short-lived tokens, encrypting data in transit and at rest, and confirming where the provider processes and stores what your application sends it. For developers embedding video, sovereignty and security meet at three points:

• Authentication: short-lived, signed tokens scoped to a room and role.
• Encryption: media encrypted in transit, and recordings and transcripts encrypted at rest, with end-to-end encryption available for sensitive calls.
• Data location and sub-processors: where media, recordings, transcripts and webhook payloads are processed and stored, and whether any sub-processor sits under foreign jurisdiction.

Our video API security guide covers the controls to check before you build.

How Digital Samba approaches EU data sovereignty

Digital Samba S.L. is a Spanish company based in Barcelona, so we're subject to EU law. Our video infrastructure runs in European data centres, with no US hyperscaler in the media path.

Calls use TLS (1.3 where the client supports it) and media uses DTLS-SRTP. Recordings are encrypted at rest with AES-256-GCM, including the off-site backup copy, and transcripts are encrypted at rest as well. End-to-end encryption is optional. Transcription isn't available on end-to-end encrypted calls, and recording a call suspends its end-to-end encryption, so you choose one or the other.

On-device features such as background blur and noise suppression run in the browser. Transcription and summaries are handled by GreenPT, a Dutch sub-processor, which processes them in memory on EU infrastructure. Our agreement with GreenPT forbids training on customer data.

Our DPA names every sub-processor: four in the EU (GreenPT is one of them), one in Switzerland for overflow capacity, and one optional US sub-processor, HubSpot, which handles support tickets and plays no part in the media path. Customers can exclude it to keep processing in Europe. You can read more on the data privacy page, or see the developer side on Digital Samba Embedded, our fully white-labelled video API and SDK.

How to check whether a video provider is sovereign

Sovereignty claims are easy to make and harder to prove, so put the provider's architecture to a short test. Ask each of these in writing:

• Where are media, recordings and transcripts processed and stored?
• Who legally owns and operates the infrastructure, including any cloud host in the media path?
• Is any sub-processor or cloud host subject to foreign law, such as the US CLOUD Act?
• Who holds the encryption keys, and can they be kept in the EEA under your control?
• Is a DPA available, and can the provider name its sub-processors?

A sovereign provider should answer each one directly instead of pointing only to a server location. To put the same questions to Digital Samba, talk to our team or read our DPA.

Frequently asked questions

What is the difference between data residency and data sovereignty?

Data residency describes where data is physically stored, while data sovereignty describes which legal system controls it. Data can reside in an EU data centre yet still be subject to foreign law if the company operating it falls under that jurisdiction. Sovereignty requires European operation and legal control as well as a European server location.

Can US authorities access data stored in the EU?

Under the US CLOUD Act, US authorities can use legal process to compel providers subject to US jurisdiction to disclose data they hold or control, wherever it is stored. Data held in an EU data centre can therefore be exposed if the provider, its parent or its cloud host has a US connection. That is why the operating company's legal home matters as much as the server location.

Does end-to-end encryption remove the CLOUD Act risk?

It reduces the risk but doesn't remove it. End-to-end encryption keeps keys with participants, so a provider can't hand over readable content it has no access to, but the provider's legal obligations don't change and metadata may still be reachable. A provider also can't process content it can't read, so recording, transcription or server-side AI means giving up end-to-end encryption for that call.

Is an EU region from a US provider enough for sovereignty?

An EU region on its own isn't enough. A provider's EU data boundary or EU region fixes where data is stored and processed, but it doesn't change which jurisdiction the operating company answers to. If that company is subject to US law, EU residency doesn't put the data beyond a US access order.

Is the EU-US Data Privacy Framework still valid?

Yes, it remains in force. It was adopted in July 2023 and upheld by the EU General Court in September 2025, though that ruling has been appealed to the Court of Justice, so its future is not settled. Because its two predecessors were struck down, many organisations avoid relying on it as their only safeguard.

Which EU rules affect video conferencing beyond the GDPR?

Beyond the GDPR, NIS2 sets cybersecurity duties for essential and important entities, DORA sets operational-resilience rules for financial services and their technology suppliers, and the EU Data Act governs data access, portability and switching. Depending on how AI features are used, the EU AI Act may apply as well.

Does sovereignty cover metadata, logs and support access, or only recordings?

A sovereignty review should cover all of them. Media, recordings and transcripts are the obvious data, but connection metadata, server logs and remote support access can sit outside the EU even when the call content does not. The review should ask where each of these is processed and who can reach them.