Oracle introduced two new EU cloud regions specifically designed to meet data sovereignty requirements around data storage and processing. The move comes as the EU ramps up data privacy regulations and companies like Microsoft are being fined for mishandling EU data.

The EU's main concern is a non-EU entity requesting – and successfully obtaining – data from a cloud region located in the EU. "Data that is created in the EU needs to stay in the EU," VP of Oracle Cloud Infrastructure (OCI) Leo Leung told SDxCentral.

To address that concern, Oracle's new sovereign cloud regions in Frankfurt, Germany, and Madrid, Spain, offer the same cloud services, service level agreements (SLAs), support and price point as Oracle's public cloud regions. "There's no premium to running in these regions," Leung noted. However, both EU Sovereign Cloud regions are supported by EU-based personnel and operated by separate EU legal entities.

Given that data sovereignty regulations continue to evolve, Oracle examined various existing regulations and data sovereignty approaches to determine "this is the best solution," Leung said. OCI's combination of cloud functionality and data sovereignty "is going to make this a very powerful offering," he argued.

Leung noted Oracle is unique in its sovereign cloud strategy compared to hyperscalers like Amazon Web Services (AWS), Google Cloud or Microsoft Azure, who "really focus on just logical isolation." Those providers charge a premium and set a separate policy or encryption key to maintain data sovereignty, but data can still intermingle with data or users that aren't considered sovereign.

The hyperscalers "feel like that's enough," but "we do not," Leung said.

Another common hyperscaler strategy is founded on partnering with a sovereign data center operator in the desired region, but "again, we don't feel like that's efficient," he said. "You're either giving up some amount of operational expertise to certain providers that are not used to running hyperscale regions, or you're separating the entities that are involved, [which] becomes potentially confusing when it comes to dealing with that entity."

The other sovereign option available in the market is from smaller cloud providers hosting workloads in particular countries, but "they usually don't have a lot of services," Leung said. "It'll usually be just bare compute and storage. Forget about more advanced services for data management, artificial intelligence or application development," which he noted are strengths of OCI.

In terms of network connectivity, Oracle's two initial sovereign cloud regions can be connected or disconnected to the internet and to each other. In terms of encryption, organizations typically want the "key management software to reside outside of the physical confines of the cloud provider in a different location," which is also something Oracle claims to have mastered.

Oracle's sovereign cloud is part of the vendor's strategy to offer cloud services in a multitude of ways, and Leung expects this offer will lead the market. "Ultimately, while the EU Sovereign Cloud will be the most common offering in the EU [and] will address the most requirements, there are going to be cases where customers are going to do even different things within the EU, and we have offerings to satisfy those use cases as well," Leung touted.

The first 15 years of cloud were all about the public cloud. The next period in the evolution of cloud will be "having cloud services available in a lot of different ways," Leung argued. "If you kind of look at the adoption curve of cloud, I think we're at that point where you have to diversify your offerings. And we believe we have great capabilities to be able to offer the cloud a lot of different ways, including this one."