Does Digital Sovereignty Mean the State Must Do Everything Itself?

No. Digital sovereignty is effective control over data, jurisdiction, access, continuity and accountability. It does not require the state to own and operate every facility.

Latvia’s new requirements for information system hosting and data centre security took effect on 1 October 2026. They do not prohibit private data centre providers. But read the hosting routes closely and one thing stands out: for the most sensitive systems, a publicly owned facility is a notification, and a privately owned one is a decision somebody can decline.

That difference will not be settled by the text. It will be settled by practice — which is why it is worth naming now, while the practice is still forming.

What actually changed on 1 October

The instrument is Cabinet Regulation No. 602, adopted on 29 September 2026 and issued under Article 30(2) of the National Cybersecurity Law. The National Cybersecurity Centre has summarised it as establishing common requirements for hosting, data centre security, conformity assessment and the availability of telemetry data to the competent incident response authorities.

The structure is straightforward:

Geography (Paragraph 5). Unless the rules provide otherwise, a system may be hosted in a data centre in a NATO, EU or EFTA member state, or a NATO Indo-Pacific partner (IP4) country — and the processing must happen there too.
Class A systems (Paragraph 8). These must sit in a data centre whose compliance has been confirmed.
How compliance is confirmed (Paragraphs 21–22). Either a data centre auditor’s opinion, prepared against the annexes to the regulation, or a certificate recognised under Annex 3. An auditor’s opinion must be renewed at least every two years.

As someone who runs data centres, I support the objective. My concern is not whether we need security requirements for public information systems. It is whether the way we design and apply them will actually improve security — or quietly encourage an approach of “we will do everything ourselves”.

Four routes, and the asymmetry inside them

Paragraph 15 sets out where the owner or legal holder of ICT critical infrastructure may host a Class A system. This is the part worth reading twice.

Route	Facility	Where	What it takes
15.1	Its own data centre	Latvia	Processing in Latvia
15.2	A public person’s, or an operator controlled by one	Latvia	Processing in Latvia
15.3	A public person’s, or an operator controlled by one	NATO / EU / EFTA	Prior notification to the Constitution Protection Bureau
15.4	A private legal person’s	NATO / EU / EFTA	Prior positive opinion from the Constitution Protection Bureau

Compare the last two lines. Same geography, same class of system. For a publicly controlled facility, you inform the Bureau. For a privately owned one, you must obtain a favourable opinion before you host anything.

A notification is a form. An opinion is a judgement that can go either way, on a timeline you do not control. The requirements the facility itself must meet are identical — the difference is who owns it.

I am not claiming the legislation creates a monopoly. It does not. My concern is about direction: regulation, approval processes and procurement decisions can collectively push public institutions towards keeping everything inside state-owned infrastructure, even where a qualified commercial provider could offer a credible alternative. This is the same pattern I wrote about in sovereign cloud procurement across the EU, where ownership and jurisdiction are routinely treated as the same question.

Strict requirements — and exceptions

Paragraph 9 deserves attention. In exceptional cases, a subject may host a Class A system in a data centre whose compliance has not been confirmed — provided there is a documented necessity, an assessment of the risks, defined mitigation measures, and a prior positive approval from the competent supervisory authority.

That exception explicitly does not extend to the Class A systems of ICT critical infrastructure owners. For those, Paragraph 16 requires confirmed data centre compliance — including when the system sits in the organisation’s own facility.

That last clause is the right design, and it deserves credit. Owning the building does not exempt you from proving it is fit for the job.

An exception is not automatically a loophole either. There can be legitimate operational reasons for carefully controlled flexibility. But flexibility needs consistent application and accountable decision-making. If one operator must invest substantially to demonstrate full compliance while another hosting arrangement receives exceptional approval, the justification should withstand independent scrutiny. The same circumstances should produce the same decision, regardless of who owns the facility.

Otherwise what was intended as a safeguard becomes a competitive advantage for a preferred provider.

“We will do it ourselves” is not a staffing plan

This is where my concern becomes more fundamental.

If the state takes more infrastructure and operational responsibility in-house, but limited budgets prevent it from attracting and retaining the specialists that work requires, the outcome can be the opposite of what the legislation intends. Rather than reducing risk, it increases it.

Before expanding responsibilities, I would expect a credible answer to three basic questions. Who will operate the infrastructure? How will those teams be funded? How will their capability be maintained over time, as people leave and technology changes?

Requirements on paper cannot replace a professional team, practical experience and adequate resources. This is not a criticism of the people working in public institutions — many of them are excellent. It is a question about whether the policy gives them a realistic operating model, or simply more obligations.

I would also expect the full cost of an in-house or state-owned solution to be examined as rigorously as the price of a commercial service. And a tender should recognise operational capability and long-term resilience, not merely the lowest monthly fee. Compliance machinery has a way of measuring the measurable and leaving the rest unpriced.

National capability should include private expertise

Of course I have a commercial perspective. I work in this industry, and a reader should weigh what I write accordingly.

But I am not asking for lower standards, guaranteed contracts or preferential treatment. I am asking for demanding, proportionate requirements that are applied consistently — and a genuine opportunity for qualified providers to compete.

There may be sound reasons to keep particular systems in state-controlled facilities. Those decisions should be justified by the risks of the specific system, rather than treated as the default answer to every security question. Data independence is national security — and national capability is built from everything a country can actually field, public and private.

My preferred approach is straightforward: define the security outcome, require credible evidence, scrutinise exceptions, and compare the available solutions fairly.

How does this work in your country?

Does your government actively use qualified commercial data centres, or is public-sector hosting increasingly concentrated in state-owned infrastructure? Where exceptions or different approval routes exist, how do you ensure they reflect genuine security needs rather than institutional preference?

I would particularly welcome practical perspectives from colleagues in Lithuania, Estonia, the Nordics and elsewhere in Europe — including examples where public-private cooperation is working well. Dependence is easy to create and slow to undo, in either direction.

The question should not be “who owns the data centre?” It should be “which arrangement best protects the systems — and how can we demonstrate that?”

Key takeaways

Latvia’s Cabinet Regulation No. 602 has applied since 1 October 2026. It does not ban private data centre providers.
For Class A systems of ICT critical infrastructure owners, a publicly controlled facility abroad requires notification to the Constitution Protection Bureau (15.3); a privately owned one requires a positive opinion (15.4). The facility requirements are the same; the ownership is not.
Paragraph 16 applies the compliance test to an organisation’s own data centre as well. Owning the building proves nothing by itself — that part is well designed.
Paragraph 9’s exception route exists for good operational reasons, but it is only defensible if the same circumstances produce the same decision for everyone.
In-house capability is a staffing and funding question before it is a security question. Ask who operates it, who pays for them, and how that is sustained.

#Cybersecurity #DataCentres #DigitalSovereignty #Baltics #Latvia #NIS2