Data embassies: can a state keep sovereignty and jurisdiction over data stored abroad?

In 2007, some Estonian banks temporarily blocked access from abroad to keep services running within the country during the cyberattacks. To keep serving customers at home, they had to shut out access from abroad. [1]

Data embassies are the most serious legal response to a question every state, and every business, should ask: where do I keep operating from if my territory falls? Their strength lies in agreed immunity, with specific protections against the host state's powers. Assigning jurisdiction wholesale to the “owner of the data” obscures that innovation.

Estonia signed its agreement with Luxembourg on 20 June 2017. It entered into force on 16 May 2018. The aim was to preserve data and operational capacity beyond its borders, with legal guarantees negotiated in advance. That is a continuity policy worth taking seriously. [2][3]

Safeguarding functions, not accumulating copies

A data embassy hosts state records in another country with special guarantees from the host state. Estonia's is part of the state cloud and supports backup and the running of systems. Both the location of the data and what the authorities can do with it matter. [2][4]

Property, population, justice and pensions are among the registers identified in the 2022 European factsheet on Estonia. Safeguarding them means preserving public functions. Riigi IT Keskus (RIT), the state IT centre, requires each database holder to back it up and test restoration annually. Continuity is demonstrated through recovery. [4][5]

Luxembourg provides space in LuxConnect infrastructure. RIT takes responsibility for the platform's reliability, security and support. That allocation of responsibilities is worth more than any generic promise of security. [4][6]

Sovereignty is protected through specific obligations

Articles 22 and 24 of the Vienna Convention on Diplomatic Relations protect diplomatic premises and archives. Estonia's treaty acknowledges that the Convention is insufficient for this hosting arrangement and establishes its own guarantees. That is the advance: turning an aspiration for control into obligations for the host state. [2][7]

Inviolability prevents entry, searches or seizures on the agreed terms. Luxembourg's authorities need Estonian authorisation to enter the protected premises. Consent is presumed in the event of fire or another dangerous emergency requiring prompt action. Immunity protects Estonian equipment and licences installed there from legal process. Data and systems are protected as Estonian archives; communications receive specific guarantees. [2]

Luxembourg thus accepts limits on its powers. Article 8 preserves international and European Union law, supplemented where appropriate by Luxembourg law. The privileges protect property and archives, without general personal immunity for workers. Estonia retains control through an agreement, without acquiring territory or replacing all the host state's laws. [2][8]

Three routes to continuity

Monaco signed another agreement with Luxembourg in 2021, with national approvals documented afterwards. It protects premises, data and systems. It reinforces the model's value: negotiating protection between states. [10]

Bahrain chose a different approach. Its Legislative Decree 56/2018 recognises the jurisdiction and laws of the country where the foreign client is domiciled, incorporated or established over certain content. It covers public and private clients, requires designation of the country and data centre, and provides for local intervention to enforce certain foreign orders. This is a conditional allocation of jurisdiction, without general diplomatic immunity for buildings or workers. [11]

Ukraine offers the evacuation route. In December 2022, its government said it had migrated around a hundred critical registers and databases with support from Amazon Web Services (AWS). A foreign cloud helps separate risks; immunities require additional protection from the host state. [12]

The choice requires precision. A copy abroad separates locations; data localisation requirements dictate where certain data must remain. A “sovereign cloud” promises controls over infrastructure, access, keys and dependencies. Those controls deserve specific scrutiny. A private contract allocates obligations and chooses the governing law and forum; immunity from public authorities requires a different legal basis. [2][9][11]

The Gulf is a reminder that law cannot keep a server running

Reuters reported in September 2026 that AWS could not restore resources and data that had not been migrated before the outage in Bahrain. The lesson is stark: recognising foreign jurisdiction over content and keeping infrastructure running address different problems. [11][14]

Luxembourg must protect the Estonian premises against intrusion and damage. The treaty provides for emergencies and termination. Legal protection does not guarantee physical survival: electricity, connectivity and recoverable backups are essential. Restoration, failures and exit from the service deserve as much contractual attention as immunities. [2]

The uncertainty is specific: the sources do not establish a case demonstrating the effectiveness of these immunities in war or against a foreign order. [2][14][15]

CLOUD Act: the provider matters too

Extraterritoriality is a law's claim to reach situations outside its state. The US CLOUD Act requires those subject to its regime to preserve or disclose information in their possession, custody or control, even when it is stored outside the United States. It operates through the relevant legal procedure. [15]

Choosing a country without examining the provider leaves the decision incomplete. The contracting entity, parent company, remote access and effective control matter. China's intelligence law also imposes duties of cooperation on organisations and citizens; enforcing them in Luxembourg requires a basis distinct from that domestic obligation. The analysis must follow the actors who control the data. [16]

Citizens retain their rights

State protection of archives must preserve individuals' rights. The General Data Protection Regulation (GDPR) continues to govern processing within its scope. The Estonia–Luxembourg hosting arrangement is within the European Union. For destinations in third countries, international transfer rules also apply. A legal basis, responsibilities and security remain requirements. [9]

For non-personal data, Regulation 2018/1807 limits national localisation requirements within the Union, with exceptions for public security. The Data Act adds measures against certain forms of government access from third countries that conflict with applicable law. Data flows and protection have their rules; diplomatic status needs its own. [17][18]

Spain: demonstrating that a backup can be restored

Spain's priority should be to demonstrate restoration within permitted locations. Spain's National Security Framework (Esquema Nacional de Seguridad, ENS) requires backups and continuity when the usual resources are lost. For high availability requirements, the corresponding enhanced measure requires sufficient separation to prevent one incident from affecting both the original and the backup. The backup can be within the country. [19]

Article 46 bis of Law 40/2015 requires the public systems and processing it lists to be located and provided within the European Union. It sets rules and exceptions for transfers to third countries. Its scope is specific, without requiring all public data to remain in Spain. [20]

The NubeSARA agreement published in 2025 describes hybrid storage and computing with redundancy and fault tolerance. It is public infrastructure designed to sustain services. Its value should be measured by its recovery capacity. [21]

Norway: making control concrete and respecting archives

Norway needs to translate national control into verifiable decisions. The sikkerhetsloven, its Security Act, protects information whose loss, alteration, disclosure or unavailability would harm national interests. The law does not require all data to remain in Norway. The 2025 digitalisation circular requires assessment of technological risks and consideration of cloud services alongside other alternatives. [22][23]

The government announced plans for a national cloud intended to control critical infrastructure and functions. Digitaliseringsdirektoratet (Digdir), Norway's digitalisation agency, points out that a provider's standard terms leave the client responsible for understanding security and how responsibilities are allocated. Accepting those terms without understanding the responsibilities leaves control in the provider's hands. [24][25]

The transition to the new arkivlova, the Archives Act, in 2026 retained the previous export rule. Nasjonalarkivet, Norway's national archives authority, interprets it as allowing digital copies abroad if the complete archive remains continuously stored in Norway. That distinction should determine backup design. [26]

As of 7 November 2026, the Data Act was under consideration for incorporation into the European Economic Area Agreement. Its application in Norway requires verification of that incorporation. [27]

Four answers that should already exist

The lesson for businesses and law firms is to decide what must survive and demonstrate how to recover it. Country, provider, access, keys, restoration and exit are all part of that decision. In a law firm, professional confidentiality must guide any transfer of case files or granting of access. [9][19][25]

These four questions should have answers today:

• Where do we keep operating from if our premises become unusable?
• What data must we recover, how quickly, and with what tolerable loss?
• Who can access case files, on what basis, and with what guarantees of confidentiality?
• When did we last test restoration, and how do we leave the provider with a usable copy?

Sources

[1] EST12 · Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective · Rain Ottis / Cooperative Cyber Defence Centre of Excellence · 2008.

[2] EST01 · Agreement between the Republic of Estonia and the Grand Duchy of Luxembourg on the hosting of data and information systems · República de Estonia y Gran Ducado de Luxemburgo · 2017-06-20 / EST05 · Estonia to establish the world’s first data embassy in Luxembourg · Gobierno de Estonia · 2017-06-20.

[3] EST02 · UN Treaty 55178: Agreement on the hosting of data and information systems · Secretaría de Naciones Unidas; registro presentado por Luxemburgo · 2018-05-16.

[4] EST06 · Andmesaatkond: turvaline hoiustamine [kriitiliselt] olulistele andmekogudele · Riigi IT Keskus (RIT) · s.f. / EST07 · Data Embassy · e-Estonia / Estonian Business and Innovation Agency · s.f.

[5] EST09 · Digital Public Administration factsheet 2022: Estonia · Comisión Europea / NIFO · 2022.

[6] EST08 · E-embassies in Luxembourg · Gobierno del Gran Ducado de Luxemburgo · s.f.

[7] EST15 · Vienna Convention on Diplomatic Relations, 1961 · Naciones Unidas · 1961-04-18.

[8] EST03 · Dossier parlementaire 7185 y Mémorial A n.º 1029, loi du 1er décembre 2017 · Chambre des Députés y Journal officiel du Grand-Duché de Luxembourg · 2017-12-06.

[9] MAR01 · RGPD — Reglamento (UE) 2016/679 · Parlamento Europeo y Consejo · 2016-05-04.

[10] CAS01 · Acuerdo Luxemburgo–Mónaco sobre alojamiento de datos y sistemas de información, 15-7-2021; Ley 28-11-2022 y publicación Mémorial A-614 · Gobiernos de Luxemburgo y Mónaco; Chambre des Députés · 2022-12-08 / CAS02 · Ley 1.545 de20-4-2023 que aprueba ratificación del Acuerdo de alojamiento Luxemburgo–Mónaco · Principado de Mónaco; Journal de Monaco8640 · 2023-04-28.

[11] CAS05 · Legislative Decree No.56 of2018 In Respect of Providing Cloud Computing Services to Foreign Parties · Reino de Baréin; reproducción inglesa Bahrain Economic Development Board · 2018.

[12] CAS14 · AWS supports Ukraine with USD75million for cloud technologies · Ministerio Transformación Digital de Ucrania; Cabinet of Ministers · 2022-12-01.

[14] CAS16 · Amazon’s AWS unable to restore access to Bahrain, one UAE cloud data zone after war damage · Reuters; Feras Delatey; sindicación WHBL · 2026-09-15.

[15] MAR04 · 18 USC 2713 — Required preservation and disclosure · Cámara de Representantes de EEUU · 2018-03-23 / MAR05 · CLOUD Act — texto legislativo · Congreso de EEUU / DOJ · 2018-03-23.

[16] MAR06 · 中华人民共和国国家情报法 · Asamblea Popular Nacional / MIIT Qinghai · 2022-04-17.

[17] MAR02 · Reglamento (UE) 2018/1807 · Parlamento Europeo y Consejo · 2018-11-28.

[18] MAR03 · Reglamento de Datos (UE) 2023/2854 · Parlamento Europeo y Consejo · 2023-12-22.

[19] MAR07 · RD 311/2022 Esquema Nacional de Seguridad · Gobierno de España / BOE · 2022-05-04.

[20] MAR08 · Ley40/2015 art46bis · Jefatura del Estado / BOE · 2015-10-02 / MAR09 · RDL14/2019 art4 · Gobierno de España / BOE · 2019-11-05.

[21] MAR10 · Convenio AEAD–AESIA NubeSARA · Secretaría de Estado Función Pública / BOE · 2025-09-08.

[22] MAR11 · Sikkerhetsloven · Stortinget / Lovdata · 2018-06-01.

[23] MAR15 · Digitaliseringsrundskrivet · Gobierno de Noruega · 2025-05-27.

[24] MAR12 · Totalberedskapsmeldingen Meld.St.9 2024–2025 · Gobierno de Noruega · 2025-01-10.

[25] MAR16 · Vurdering av risiko · Digitaliseringsdirektoratet · 2025-08-21 / MAR23 · Økning i løsepengevirus · NSM (Norwegian National Security Authority) · 2022-01-06.

[26] MAR17 · Endringar i lovar og forskrifter frå1januar2026 · Gobierno de Noruega · 2025-12-22 / MAR18 · Skylagring og skanning i utlandet · Nasjonalarkivet · s.f.

[27] MAR19 · Factsheet32023R2854 · EFTA · s.f. / MAR20 · Oversikt over EU-regelverk om deling og bruk av data · Digdir · s.f.