Data Sovereignty in a VUCA world: why flexibility matters more than absolutes

Data sovereignty is not a new concern for European businesses.

Since the introduction of GDPR in 2018, organizations have been required to carefully manage how and where personal data is stored, processed, and protected.

In various regions and in more heavily-regulated industries, there are additional requirements that also apply.

The problem is that these requirements are not static, but they change over time — sometimes on a more or less predictable schedule, as in the case of the various banking regulations that spring from the Basel Accords, but sometimes far more suddenly and unexpectedly.

In the same way, in the past, technical roadmaps used to be easy to determine well ahead of time, and would then require only minor tuning.

In more recent years, the pace of change in technological strategy has accelerated relentlessly, in response both to new technical capabilities (where was AI before 2022?), and new commercial models such as the rise of SaaS and consumption-based billing.

Living in a VUCA environment

The U.S. Army War College introduced the term VUCA (volatility, uncertainty, complexity, and ambiguity) in 1987 to describe the emerging global environment at the close of the Cold War.

Almost four decades later, 2025 has brought an intensification of VUCA that is arguably greater than at any point since. Geopolitical shifts, new regulations, and rapid technological change are all converging, often arriving faster than organizations can fully adapt.

In this environment, business leaders are already storm-proofing their operations, strengthening supply chains, and reassessing risk. But IT cannot be overlooked. A strategy is only as strong as the systems that execute it, and if those systems are rigid or slow to adapt, even the most forward-looking plan can fall behind.

Companies that build flexibility into their technical foundations are better positioned to pivot quickly when conditions change, gaining an advantage over peers who remain constrained by inflexible architectures.

Building resilience through flexibility

To navigate this heightened uncertainty, organizations should focus on preserving freedom of decision in their IT strategies. Four principles particularly stand out.

Firstly, maintaining data sovereignty across a spectrum of delivery options; be it public cloud, private cloud, and on-premises solutions is essential.

Each model offers unique benefits and trade-offs. A mix of these approaches ensures that businesses can adapt quickly as regulations, compliance needs, and operational requirements shift.

Second, designing systems with vendor independence in mind helps minimize lock-in and protects one’s business against the risk if a provider’s offering becomes unavailable or non-compliant. Building with flexibility ensures companies can pivot as needed without major disruption.

Another valuable technique is adopting a composable architecture made up of modular components. This allows businesses to integrate new capabilities without undergoing large-scale overhauls, ensuring today’s technology choices don’t limit tomorrow’s opportunities.

Finally, prioritizing rapid time-to-value is key. Focusing on projects that deliver tangible results quickly reduces the risk of long, costly initiatives becoming obsolete before completion and maintains momentum.

Integration at the core

Large, multi-year platform migrations are increasingly difficult to justify in such a volatile environment. Instead, resilience often comes from smarter, more flexible integration of the systems already in place.

Strong integration not only connects data and workflows today but also creates the agility to reconfigure as new systems, applications, or AI capabilities are introduced.

The same principle applies to AI. While ambitious research projects have their place, the greater value in the near term lies in deployment-ready use cases that solve real business problems and can deliver measurable benefits.

In a landscape defined by volatility, it is these near-term, high-impact wins that help organizations maintain momentum while preparing for what’s next.

Decision sovereignty as the goal

In the end, a perfect and unchanging technological strategy that is robust against all regulatory, business, and technological change is probably not achievable, nor even necessarily desirable.

Rather than narrow “digital sovereignty”, which risks degenerating into digital autarky, the true objective should be decision sovereignty: the ability to adapt quickly, reconfigure when needed, and keep pace with an environment that shows no signs of slowing down.

The latest example of this is MCP. Rather than fighting the adoption of AI or trying to force it into narrow channels, this new protocol enables corporate IT departments to connect existing core systems and data sets to AI systems in a way that is both sustainable and manageable.

This is a timely example of how organizations can build on what already exists and extend it into new capabilities, delivering valuable new capabilities to users and customers.

By combining flexible delivery models, vendor independence, composable architectures, and strong integration, enterprises can reduce risk without closing themselves off from the innovations that fuel competitiveness.

In a VUCA-dominated world, the most resilient organizations will not be those that make sweeping breaks, but those that can change direction swiftly when the landscape shifts yet again.

We've featured the best secure file sharing.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro