In the news: why data control is becoming a boardroom issue again

Digital autonomy begins with data control

Operating from a monumental building once owned by textile magnate Menko, private cloud provider Fundaments is focused firmly on the future. According to the company, that future is less about which cloud an organization uses and more about where data resides, who has access to it, and which legislation governs that information.

Over the past 25 years, Fundaments has evolved from a hosting company into a provider of private cloud solutions. Throughout this time, data protection has always been central, says Verschuren. “We were sovereign before the term even gained traction. That has always been our—largely unseen—strength.” Now that digital autonomy is high on the agenda for governments, healthcare institutions, and other organizations, the company finds that this approach is becoming relevant once again.

Practical choices

The fact that digital sovereignty has grown from a niche concept into a boardroom issue in recent years is due to several factors, according to Verschuren. Geopolitical developments, increasing dependence on foreign technology companies, and new laws and regulations have forced organizations to re-evaluate their IT landscapes.

At the same time, he emphasizes that the discussion should not devolve into a choice between public or private cloud. “You should never choose just one cloud.” According to him, the challenge lies in determining which systems and data must remain available and controllable under all circumstances, and which can safely reside in a public cloud environment.

In this context, Verschuren points to the European Cloud Sovereignty Framework, which uses eight dimensions to help organizations concretely assess the level of sovereignty in cloud environments. “Sovereignty is no longer just a marketing term. It has become a practical definition.”

According to Verschuren, every party has its own role to play. Hyperscalers like Microsoft, Amazon, and Google remain a logical choice for many applications. At the same time, organizations need alternatives for data and applications that require maximum control.

“We never provide the entire solution, always a part of it,” he says. Fundaments focuses primarily on the technological component. For issues regarding processes, governance, and organization, the company collaborates with partners. Since 2022, this has been done in part through Interstellar, where various IT specialists jointly develop solutions for secure and scalable cloud environments.

‍

Back to data first

According to Verschuren and Boscu, the current discussion is often wrongly framed as a debate about cloud technology. In reality, it is all about data.
Over the past twenty years, many organizations have undergone a clear evolution. Initially, systems and data were primarily on-premises. Then, the focus shifted to cloud migration. Later, a near-automatic preference for cloud solutions emerged.

Boscu has witnessed this development firsthand. “Back when I was in a commercial role, we frequently had stressful conversations with IT decision-makers who feared that moving to the cloud would mean losing their grip on their data.”

Once that resistance faded, the pendulum swung to the other extreme, according to him. A tidal wave where IT strategy shifted from data-first to cloud-only. “An almost naive belief in the benefits and cheap alternatives of the cloud. In other words: from one extreme—keeping all data on-prem for control—to the other: everything in the cloud because it’s simpler and cheaper. We were all part of that.”

According to Boscu, organizations are now returning to a more fundamental question: where is the data located, and what risks are associated with it? This is particularly prominent in sectors like government and healthcare. Many systems there contain sensitive personal data, medical records, or other information that should not be readily accessible to third parties.

“Previously, it might have been the case that everyone dumped all their data into a hyperscaler cloud via Microsoft 365. Now, people realize that you first need to think carefully about which data can safely reside there and which data you truly want to keep sovereign under all circumstances.”

AI as an accelerator

The rapid rise of AI only makes that discussion more urgent, according to Verschuren. More and more employees are using generative AI solutions for daily tasks. This creates the risk that confidential information may unintentionally end up in external systems.

To highlight this phenomenon, the CTO points to research suggesting that approximately ten percent of the data entered into ChatGPT consists of confidential organizational data. “That means we still don’t have sufficient control over our data.”

He believes organizations should therefore not only think about cloud strategies but also about how AI applications are used. Legislation like the AI Act can help raise awareness. “Much of the data put into AI applications is also used to further train those applications. So, be very careful about what data you do and do not put into AI tools.”

In practice, he says this means organizations must consciously position their most sensitive data—their crown jewels—in environments where they retain maximum control. And that is, generally speaking, a private cloud based in Europe, or preferably, the Netherlands.

‍

Boardroom issue

While digital autonomy was primarily a topic for IT departments for years, Boscu sees the conversation shifting to the boardroom. Legislation like the American CLOUD Act has existed for years but, according to him, received little attention for a long time. The changing geopolitical situation has fundamentally altered that.

“Now you see someone in the White House who disregards everything and says they are prepared to use that legislation. And now the realization is dawning at the C-level that control over data—digital autonomy—is once again a boardroom issue, whereas for ten to fifteen years it was only about flexibility, speed, and money.”

According to Boscu, this may be the most important lesson of recent years. Organizations must not fall back into one-sided technology choices but should structurally continue to look at risks, control, and data ownership. “I hope we all learn from this by not letting go of our grip on data and a risk-driven approach again.”

Always data-first as a starting point

For Fundaments, this does not mean a change of course, but rather a confirmation of a principle that, according to the company, never disappeared. “Fundaments has been in the data-first phase for 25 years. Now you see that we are also being involved in this discussion from the technology side because we never abandoned our principles. That makes it easier to work with end-users to initiate that move toward greater data control.”

Fundaments will have a booth at the Overheid 360° Congress on Wednesday, June 17, in Utrecht.