Data sovereignty under RISE versus brownfield.

Data sovereignty is the unresolved variable in many RISE with SAP evaluations. The headline answer is that RISE supports sovereignty through regional hyperscaler choice, sovereign cloud regions, and contractual commitments on data location. The fuller answer is that RISE introduces sovereignty considerations that brownfield does not have, because brownfield keeps data inside the enterprise perimeter by default and RISE moves it to a managed service that the enterprise does not directly operate. The legal, contractual, and operational differences matter for any enterprise operating in regulated industries, in jurisdictions with strict data residency requirements, or in markets where sovereign cloud regulation is still evolving. A buyer side analysis that treats sovereignty as a checklist will miss the substance. A buyer side analysis that treats it as a multi dimensional question will surface the actual differences and produce a decision the legal team can defend.

01.What sovereignty means in this context

Data sovereignty is the principle that data is subject to the laws of the jurisdiction in which it physically resides, and that the entity controlling the data is subject to the legal jurisdiction in which it operates. The two dimensions are connected but not identical. A data set can be physically located in one jurisdiction while the controlling entity is subject to a different jurisdiction, which produces a sovereignty exposure even when the data location appears compliant.

Sovereignty considerations vary by industry and by jurisdiction. Financial services, healthcare, pharmaceuticals, defence, and public sector typically have explicit data location requirements imposed by regulators. Other industries face implicit requirements driven by customer expectations or by contractual commitments to enterprise clients.

Sovereignty is also evolving rapidly. The European Union, the United Kingdom, Switzerland, India, China, Saudi Arabia, Brazil, and several other jurisdictions have introduced or strengthened sovereignty requirements in the last five years. The regulatory environment in 2026 is meaningfully more demanding than the environment in 2020, and the trajectory continues to tighten rather than loosen.

The buyer side analysis needs to capture both the current regulatory state and the trajectory. A RISE contract signed in 2026 will be subject to the regulatory environment of 2030 and beyond, which may impose requirements that the current contract does not address.

02.How brownfield handles sovereignty by default

Brownfield handles sovereignty by default because the data resides on infrastructure that the enterprise directly controls. The data centre is in a known jurisdiction. The operational team is employed by the enterprise. The legal access to the data is governed by the enterprise's own contracts with its employees and contractors.

The default position is usually compliant with most jurisdictional requirements, although there are exceptions. Cross border replication for disaster recovery can introduce sovereignty considerations. Use of third party support contractors can introduce access considerations. The default position is compliant in most cases but not in all, and a careful brownfield estate has explicit controls in place for each exception.

The default position is also relatively easy to demonstrate to regulators and auditors. The data centre location is fixed and documented. The operational team is known and credentialled. The access logs are produced by systems under the enterprise's direct control. The evidentiary chain is short and clear.

The simplicity of the brownfield default is sometimes overlooked in RISE evaluations. The default is not free, the data centre and the operational team are both significant cost lines, but the sovereignty posture is well understood and easy to defend, which has its own value for regulated enterprises.

03.How RISE handles sovereignty contractually

RISE handles sovereignty through contractual commitments. The RISE contract specifies the region in which the data will reside, the hyperscaler that will host it, and the parties that will have access to it. The commitments are real and SAP holds itself to them. The commitments are also bounded by the contractual language, which means anything not addressed in the contract may not be covered.

The region selection is the first sovereignty decision. Most hyperscalers operate multiple regions, and RISE can be deployed in any of them subject to capacity availability. The buyer chooses the region based on the applicable regulatory requirements. Common choices include EU regions for European data, US regions for US data, and dedicated sovereign regions for jurisdictions that require them.

The hyperscaler selection is the second decision. The hyperscaler operates the physical infrastructure and has its own contractual relationship with the enterprise indirectly through SAP. The hyperscaler is subject to its own home jurisdiction's legal regime, which can introduce sovereignty exposure even when the data is physically located in a different region.

The access controls are the third decision. RISE includes operational access for SAP personnel and for hyperscaler personnel. The personnel are based in specific countries, employed under specific legal regimes, and subject to specific clearance requirements. The buyer needs to understand who has access to the data and where they are, not just where the data itself is stored.

04.The sovereign cloud option

For enterprises with strict sovereignty requirements, RISE can be deployed in sovereign cloud regions operated by the hyperscalers in partnership with local sovereign cloud providers. Examples include the Bleu joint venture in France, the Delos partnership in Germany, and the various sovereign cloud offerings in Saudi Arabia and the Gulf states.

Sovereign cloud regions provide additional commitments on data location, operational personnel citizenship and clearance, and legal jurisdiction. The commitments are designed to satisfy regulatory requirements that the standard hyperscaler regions do not satisfy.

The sovereign cloud option is available with RISE but at a different commercial profile. The infrastructure cost is typically twenty to forty percent higher than the equivalent standard region. The feature set is sometimes narrower because new hyperscaler services take longer to reach sovereign regions. The operational maturity is sometimes lower because the regions are newer.

The cost premium and the feature constraints need to be weighed against the regulatory benefit. For enterprises that genuinely require sovereign cloud, the trade off is worth it. For enterprises that are using sovereignty as a procurement lever without a binding regulatory requirement, the trade off may not be worth it, and a standard region with strong contractual commitments may be sufficient.

05.Operational sovereignty beyond data location

Sovereignty is not only about data location. It is also about operational control. Brownfield gives the enterprise full operational control by default. RISE gives the enterprise contractual control over a service that is operated by SAP and the hyperscaler.

The operational control difference matters for use cases that depend on direct intervention. Custom monitoring, custom security tooling, custom data loss prevention, and custom incident response all require operational access that RISE limits and brownfield does not. The limits are not absolute, but they are real, and they need to be factored into the sovereignty assessment.

The control difference also matters for incident response. When something goes wrong on brownfield, the enterprise's own team responds directly. When something goes wrong on RISE, the response is mediated through the SAP service desk and the hyperscaler support function. The mediation adds time and reduces visibility, both of which can be significant in regulated industries where incident response timelines are themselves a regulatory requirement.

The buyer needs to assess operational sovereignty as a parallel question to data sovereignty. The two together produce the full sovereignty picture, and they often produce different answers for the same enterprise depending on which dimension is more material to the specific regulatory environment.

06.Building the sovereignty assessment

The sovereignty assessment is a parallel workstream to the TCO assessment in any serious RISE evaluation. The assessment is owned by the legal function, with input from compliance, security, and operations. The assessment produces a written analysis that documents the sovereignty exposure under each candidate path and the controls required to manage the exposure.

The analysis covers the regulatory requirements in each jurisdiction in which the enterprise operates, the contractual commitments that each candidate path provides, the operational controls that complement the contractual commitments, and the residual risk that remains after the controls are in place.

The output is a sovereignty scorecard that ranks each path against the regulatory requirements. The scorecard reveals where each path has a strong sovereignty posture, where it has a weak posture, and where additional commitments or controls are needed to bring the posture up to standard.

The scorecard is the basis for the legal sign off on the RISE decision. It is also the basis for the contractual negotiation with SAP on sovereignty specific clauses. Buyers who walk into the SAP commercial conversation with a sovereignty scorecard in hand tend to extract stronger sovereignty commitments than buyers who treat sovereignty as a checkbox at the end of the negotiation.

RISE handles sovereignty through contractual commitments. The commitments are real and SAP holds itself to them. The commitments are also bounded by the contractual language, which means anything not addressed in the contract may not be covered.

07.Conclusion

Data sovereignty is a multi dimensional question that brownfield handles by default and RISE handles by contract. The contractual approach is workable for most enterprises, but it requires the buyer to think carefully about every dimension of sovereignty that the contract needs to address. The dimensions include data location, hyperscaler jurisdiction, operational personnel access, sovereign cloud availability, and operational control over the service. Enterprises that build a sovereignty assessment as a parallel workstream to the TCO assessment, with the legal function leading the work, produce decisions that hold up under regulatory scrutiny and audit review. Enterprises that treat sovereignty as a checkbox produce decisions that look adequate at signing and become a problem in year three or year four when a regulator or an auditor asks a question the contract did not anticipate.