Kyndryl acquires Solvinity, raising data sovereignty concerns

Kyndryl, a leading US IT services provider, has announced plans to acquire the Dutch cloud company Solvinity. While the deal aims to expand Kyndryl's secure cloud offerings, it raises concerns about data sovereignty as Solvinity's services will fall under the jurisdiction of the US Cloud Act, which allows the US government to access data stored by US companies, even if located abroad. Experts warn this acquisition could undermine Europe's efforts to build its own digital infrastructure and reduce reliance on American tech giants.

Kyndryl's acquisition of Solvinity, announced on November 4, 2025, aims to bolster its secure managed cloud services in the Netherlands. The deal combines Kyndryl's expertise in advisory, implementation, and managed services with Solvinity's private and hybrid sovereign cloud offerings. According to Petra Goude, President of Kyndryl Strategic Markets, this acquisition will enable Kyndryl to offer expanded services in modernising, innovating, and securing sensitive and complex workloads for its customers. The expanded capabilities are intended to support customers running highly sensitive workloads while adhering to stringent security and compliance requirements, as well as navigating evolving data sovereignty regulations. Kyndryl's customers are expected to benefit from an enhanced portfolio of security capabilities, cloud platform services, AI enablement, and the company's team of experts with national and international certifications. The financial terms of the transaction remain undisclosed.

Data sovereignty concerns and the US CLOUD Act

The acquisition has sparked concerns in the Netherlands and across Europe due to the implications of the US CLOUD Act. This law allows the US government to demand data from US-based companies, regardless of where that data is stored. With Solvinity, which is active in the Dutch government market, now falling under US jurisdiction, there are fears that sensitive government data managed by Solvinity could be accessed by the US government. This raises significant questions about data privacy and digital sovereignty, particularly as Solvinity manages the Justitienet environment for the Dutch Ministry of Justice and Security. Some experts view the acquisition as an 'undesirable situation', fearing that the Dutch government may not react swiftly enough, given its past inaction in similar cases. Concerns have also been raised about potential oversight of Solvinity’s engineers by the US parent company.

European push for digital sovereignty

The acquisition of Solvinity comes at a time when Europe is actively seeking to strengthen its digital sovereignty and reduce its reliance on US tech companies. The Dutch House of Representatives has even voted in favour of a motion to accelerate investment in European cloud alternatives. This motion, proposed by MP Koekkoek (Volt), aims to safeguard Europe's digital autonomy, recognising it as essential for economic, technological, and national security. The motion also calls for the EU to advocate for accelerated investments in European cloud alternatives and digital infrastructure, and requests the Dutch government to identify additional national resources to stimulate European cloud solutions. Despite substantial investments from US tech companies like Amazon Web Services (AWS) in the EU, the need for European alternatives remains strong due to concerns about data access under the CLOUD Act.

The EuroStack Report

A recent EuroStack report has urged Europe to build its own digital future, calling for a €300 billion investment to transform Europe into a global leader in values-driven, sustainable digital innovation. The report outlines a vision for a European digital ecosystem rooted in sovereignty, sustainability, and democratic values. It recommends creating an EU Sovereign Tech Fund, focusing on 'Made-in-Europe' standards, and pursuing strategic public-private partnerships. The EuroStack initiative proposes a federated, decentralised approach that leverages Europe's diversity while maintaining strategic coordination. Proposed infrastructure includes EuroChips (homegrown semiconductor production), SovereignCloud (secure European cloud services), SmartEurope IoT networks, DataCommons for federated data sharing, and SovereignAI services. Without a strong internal digital infrastructure, Europe risks job losses, diminished value creation, technological dependence, and an erosion of democratic control over sensitive information.

Sovereign clouds: a global trend

Governments worldwide are increasingly exploring 'sovereign clouds' to manage and protect sensitive data within their own jurisdictions. These internal cloud systems aim to provide more domestic control and autonomy, insulating data from geopolitical conflicts and global cloud network outages. The US CLOUD Act of 2018 is a key driver for governments to adopt sovereign clouds, ensuring that sensitive information is held within the country's jurisdiction. Sovereign clouds also offer economic benefits by localising cloud infrastructure, creating high-quality technology jobs, and fostering a self-sustaining digital ecosystem. Key criteria for a successful sovereign cloud include infrastructure control and ownership, data residency and compliance, data segregation and isolation, data security and user privacy, operational control and training, service quality and reliability, transparency and governance, and scalability, innovation, and interoperability.

Implementing sovereign clouds

Implementing sovereign clouds is not without its challenges, including high costs, skills gaps, and the need for effective partnerships. Governments must balance leveraging the tools provided by hyperscalers with ensuring data sovereignty. Two prevalent models exist: a hyperscaler cloud with sovereignty features (managed by hyperscalers, offering cost savings but limited control) and a sovereign cloud with a hyperscaler (fully local control but more expensive and complicated to implement).