Shadow AI in the workplace

The EU Data Act (Regulation (EU) 2023/2854) entered into force on 11 January 2024 and has applied since 12 September 2025. It obliges cloud providers to make customer data portable and to remove the barriers that keep customers locked in.The practical implications are highly relevant for IT decision-makers, but many are still unaware of the regulation.---

Cloud backup looks cheap on the price list: a few cents per gigabyte per month for archive-tier storage. The surprise comes when you retrieve your data, for a recovery, a migration or a restore test. Outbound transfer (egress) to the internet is typically priced around USD 0.05 to 0.09 per GB at hyperscaler list rates, several times the monthly storage cost of the same gigabyte.At that rate, retrieving 100 TB costs roughly USD 5,000 to 9,000 in transfer fees alone. For backup workloads, where full retrieval is exactly the scenario you are paying for, this changes the economics fundamentally.---

"Data sovereignty" appears in every cloud provider's marketing. But what does it actually mean? And how does it differ from data protection?A simple definition: **Data sovereignty means you have full control over your data: legally, technically and operationally.**This article explains the three dimensions and why they matter for your organisation.---

This is one of the most common misconceptions in cloud procurement: "My data sits on a server in Frankfurt, so it is out of reach for US authorities."That assumption is wrong. The **US CLOUD Act** makes the server location largely irrelevant when the provider is a US company.---

The GDPR permits cloud storage, but under strict conditions. Third-country transfers (to the US, China and other non-EU countries) are particularly complex. Many organisations do not realise that their current setup falls short of the requirements.This article explains the GDPR requirements for cloud storage and where the legal risks sit.---