In the news: why control over data is becoming a boardroom issue again

Digital autonomy starts with control over data

From a historic building once owned by textile magnate Menko, private cloud provider Fundaments is focused firmly on the future. According to the company, that future is becoming less about which cloud an organization uses and more about where its data resides, who has access to it, and which laws govern it.

Over the past 25 years, Fundaments has evolved from a hosting provider into a private cloud specialist. Throughout that journey, protecting data has always been central, says Verschuren. “We were sovereign before the term became popular. That has always been our strength, largely unnoticed, but fundamental to everything we do.”

Now that digital autonomy has become a key priority for governments, healthcare organizations, and other sectors, Fundaments is seeing renewed interest in this approach. Organizations are increasingly recognizing that true digital autonomy starts with understanding, controlling, and safeguarding their data.

Practical choices

According to Verschuren, the fact that digital sovereignty has evolved from a niche concept into a boardroom issue over the past few years is driven by several factors. Geopolitical developments, increasing dependence on foreign technology providers, and new regulations have forced organizations to reassess their IT landscape.

At the same time, he emphasizes that the discussion should not devolve into a choice between public and private cloud. “You should never choose a single cloud.” In his view, the real challenge is determining which systems and data must remain available and controllable under all circumstances, and which can safely reside in a public cloud environment.

In this context, Verschuren refers to the European Cloud Sovereignty Framework, which helps organizations assess the level of sovereignty of cloud environments across eight dimensions. “Sovereignty is no longer a marketing term. It has become a practical definition.”

According to Verschuren, every provider has its own role to play. Hyperscalers such as Microsoft, Amazon, and Google remain a logical choice for many use cases. At the same time, organizations need alternatives for data and applications that require the highest levels of control.

“We are never the entire solution; we are always part of it,” he says. Fundaments focuses primarily on the technological component. For challenges related to processes, governance, and organizational change, the company works closely with partners. Since 2022, this collaboration has included Interstellar, where multiple IT specialists jointly develop solutions for secure and scalable cloud environments.

Back to a data-first approach

According to Verschuren and Boscu, the current debate is too often framed as a discussion about cloud technology. In reality, it is about data.

Over the past twenty years, many organizations have gone through a clear evolution. Initially, systems and data were primarily hosted on-premises. The focus then shifted to cloud migration, followed by an almost automatic preference for cloud-based solutions.

Boscu witnessed this transition firsthand. “Even when I was already working in a commercial role, we regularly had difficult conversations with IT decision-makers who feared that moving to the cloud would mean losing control over their data.”

Once that resistance faded, however, the pendulum swung too far in the opposite direction. According to Boscu, the industry experienced a wave of enthusiasm that shifted IT strategy from data first to cloud only. “There was an almost naïve belief in the benefits and lower costs of the cloud. In other words, we moved from one extreme — keeping all data on-premises for maximum control, to the other: putting everything in the cloud because it seemed simpler and more cost-effective. We were all part of that shift.”

Today, organizations are returning to a more fundamental question: where is the data located, and what risks are associated with it? This is particularly relevant in sectors such as government and healthcare, where systems often contain sensitive personal information, medical records, and other data that should not be accessible to unauthorized parties.

“In the past, organizations might have simply placed all their data in a hyperscaler cloud through Microsoft 365. Now they realize that they first need to carefully consider which data can safely reside there and which data must remain sovereign under all circumstances.”

AI as an accelerator

According to Verschuren, the rapid rise of AI is only making this discussion more urgent. Increasing numbers of employees are using generative AI solutions in their day-to-day work, creating the risk that confidential information may unintentionally end up in external systems.

To illustrate this concern, the CTO refers to research suggesting that approximately ten percent of the data entered into ChatGPT consists of confidential organizational information. “That means that, collectively, we still do not have sufficient control over our data.”

As a result, organizations should think not only about their cloud strategy but also about how AI applications are used within the organization. Regulations such as the AI Act can help raise awareness. “Much of the data entered into AI applications is also used to further train those applications. That is why it is essential to understand which data should and should not be shared with AI tools.”

In practice, this means that organizations should deliberately position their most sensitive data — their crown jewels — in environments where they retain maximum control. In most cases, that means a private cloud hosted by a European provider, or preferably one based in the Netherlands.

A boardroom issue

While digital autonomy was primarily an IT topic for many years, Boscu sees the conversation increasingly moving into the boardroom. Legislation such as the U.S. CLOUD Act (Clarifying Lawful Overseas Use of Data Act) has existed for years, but according to him received little attention for a long time. The changing geopolitical landscape has fundamentally changed that.

“Now you see someone in the White House who is willing to use that legislation. As a result, awareness is reaching the C-level that control over data – digital autonomy – has once again become a boardroom issue, whereas for the past ten to fifteen years the focus was primarily on flexibility, speed and cost.”

According to Boscu, this may be the most important lesson of recent years. Organizations should avoid falling back into one-sided technology choices and instead continuously assess risks, control and ownership of data. “I hope we all learn from this by never again letting go of our focus on data control and a risk-driven approach.”

Always data first

For Fundaments, this does not represent a change in direction, but rather a confirmation of a principle that, according to the company, has always remained in place.

“Fundaments has been operating from a data-first philosophy for the past 25 years. Today, we are increasingly involved in this discussion from a technology perspective because we never abandoned those principles. That makes it easier for us to help end users make the transition towards greater control over their data.”

Fundaments will be exhibiting at the Overheid 360° Congress in Utrecht on Wednesday, June 17.