What is Data Sovereignty?

Data sovereignty refers to the concept that data, which has been generated, processed, converted, and stored in digital form, is subject to the laws of the country in which it was generated. Most public service and regulated industries require that their data be exclusively located within the jurisdiction where it was collected to comply with relevant data regulations. This is a critical factor of consideration when these organizations seek to adopt cloud services.

Many institutions within these sectors express the need to transition to cloud services. However, the adoption of traditional commercial cloud products is impeded by restrictive data requirements such as data residency and protection mandates.

SAP Data Sovereignty Solutions

With these considerations in mind, SAP provides a suite of cloud solutions tailored to meet the varying global requirements of public service and regulated industry customers. The range of cloud solutions aim to help customers navigate data regulations and security in the European Union (EU), United Kingdom (UK), United States (US), Australia (AU), New Zealand (NZ), and other countries on a case-by-case basis.

This article explores seven SAP data sovereignty solutions and considers the key features along with the benefits and drawbacks to be taken into consideration with each option.

At the end of the blog there is a summary for quick reference and comparison.

The solutions covered are as follows:

1. SAP EU Access Only Option
2. SAP UK Data Cloud
3. NS2 for the US
4. NS2 Cloud in Country (CiC)
5. SAP Sovereign Cloud tailored for Australia and New Zealand
6. Sovereign Cloud Platform for Countries with an undefined service.
7. Sovereign Cloud Platform for the Public Sector in Germany

1. SAP EU Access Only Option

The EU Access Only Option is a product that provides organizations with the tools to navigate the intricacies of EU data regulations. Specifically, this option allows customers to restrict access to their data during maintenance or service delivery by suppliers located outside of the European Union. The main objective of this product is to help customers align with their company guidelines, local statutory requirements, and industry regulations concerning data protection. This makes this service an essential consideration for customers who are subject to EU data privacy laws such as the General Data Protection Regulation (GDPR).

Target Audience:

• Organizations prioritizing compliance with EU data regulations.

Cloud Products Offered:

• This tool is only available for specific SAP cloud services, determined by the data processing location of the product (not all services qualify).
• To enable EU Access Only for eligible services, a separate contract is required. This agreement restricts remote access to the cloud system, ensuring compliance with EU data protection and privacy laws.

EU Access Only Pricing:

The SAP EU Access Only option can incur an additional cost of up to 15% of the standard cloud service net recurring fee. This cost may vary depending on the specific products licensed and your unique circumstances.

Benefits:

• Enhanced data subject privacy protection by adhering to EU data regulations.
• EU Access Only stores and processes information within the European Economic Area (EEA), minimising the risk of exposure outside strict EU data regulations.
• Any sub-processors providing support access data will also be located within the EEA/Switzerland.
• Mitigates potential fines for non-compliance with EU data regulations.

Sovereign Cloud Services

The EU Access Only Option is a tool specifically designed to aid customers in complying with Data Sovereignty regulations within the European Union. In contrast, the remaining six Sovereign Cloud solutions are customized services tailored to assist customers in complying with Data Sovereignty requirements in specific geographic regions.

The solution content is quite similar in terms of the service they each offer, but there are slight variations in the available cloud products depending on the country where it is deployed. The country specific ones offer services for the UK, US, AU and NZ, and, in countries without a defined service, the Sovereign Cloud option is available on a case-by-case basis. Each solution is tailored to meet the local data sovereignty requirements of the relevant country to ensure enhanced data security and protection.

Target Audience:

• Mission-critical workloads for government agencies.
• Commercial sectors, and regulated industries such as aerospace, defense, telecommunications, and utilities.
• Enterprises demanding high-security environments.

Pricing:

The remaining six sovereign cloud services also have a different pricing structure to the EU Access Only option. These services are charged based on a percentage of the value of the products you intend to use. For example, if a S/4HANA contract costs $1,000,000 annually and the percentage charge is 10%, then customers would pay an additional $100,000 annually.

The cost of SAP solutions can differ significantly due to various factors such as:

• Location
• Whether the deployment is on private or public cloud.
• The Cloud products included in the service.
• The Contract terms negotiated with SAP.

The percentage of cost variation can range from 15% to 88%. SAP does not publish its prices publicly for these solutions, but ITAA has extensive knowledge and experience to assist customers in achieving a favorable commercial outcome.

2. SAP UK Data Cloud

The SAP UK Data Cloud is a solution designed to deliver SAP Intelligent Enterprise cloud solutions and was launched in July 2021 in the UK.

Cloud Products Offered:

• SAP S/4HANA
• SAP SuccessFactors
• SAP Business Technology Platform
• SAP Analytics Cloud

Benefit:

• SAP utilises partnerships with major cloud providers like AWS, Microsoft Azure, and Google Cloud to ensure compliance with various data residency regulations across different UK regions.

3. NS2 for the US

SAP National Security Services, Inc (NS2) stands as an independent U.S. subsidiary of SAP that was launched in 2004, dedicated to enabling the secure adoption of U.S.-based SAP solutions. NS2 provides an enhanced deployment model that helps customers meet regulatory compliance requirements and safeguard mission-critical workloads.

Cloud Products Offered:

• SAP S/4HANA Cloud
• SAP SuccessFactors
• SAP Integrated Business Planning for Supply Chain
• SAP Analytics Cloud
• SAP Ariba Solutions

NS2 intends to broaden its portfolio of secure SAP cloud solutions for the US market, but a specific timeline is yet to be announced.

Benefit & Drawback

4. NS2 Cloud in Country (CiC)

The NS2 Cloud in Country (CiC) is a solution supported by NS2, launched in May 2021 to cater to the evolving security needs of customers beyond the US. The solution adheres to local requirements, ensuring enhanced data security and protection. Initially, extending support to customers in Canada, AU, NZ, and UK, NS2 Cloud in Country has plans for expansion into additional countries.

Cloud Products Offered:

• SAP S/4HANA Cloud
• SAP Human Experience Management (HXM)
• Business Technology Platform
• SAP Analytics Cloud

Drawback

• NS2 Cloud in Country (CiC) appears to be an earlier offering for the UK, AU, and NZ.

These regions have since transitioned to more comprehensive cloud solutions tailored specifically for their markets.

• UK Data Cloud (July 2021)
• Sovereign Cloud (2023) for Australia and New Zealand

5. SAP Sovereign Cloud tailored to Australia and New Zealand

SAP Sovereign Cloud is a compliant and secure platform launched in 2023, tailored to assist organizations in achieving their business goals. This product is designed for AU and NZ customers, as the solution ensures customer data remains within the sovereign borders of Australia. This solution provides a managed service for cloud solutions that align with the Australian Privacy Principles (APP’s).

Cloud Products Offered:

• SAP S/4HANA Cloud (Private Edition)
• SAP SuccessFactors
• SAP Analytics Cloud
• SAP Business Technology Platform

Drawback

• This service currently supports a limited selection of SAP cloud solutions. However, additional solutions are planned to be added in the future.

6. Sovereign Cloud option for Countries with an undefined service.

For countries outside the territories of the services previously outlined, there is the option to obtain sovereign cloud capabilities as a managed service for customers who require additional assurances for the cloud delivery model. Please note that this option is exclusively available upon request from SAP, and each request is evaluated on a case-by-case basis.

To deploy an option in a customer’s territory, SAP assesses country requirements, identifies cloud solutions, secures them, tests data sovereignty, and establishes an audit framework. Once completed, the cloud solutions may be deployed through a hyperscaler that meets local compliance and regulatory guidelines.

Cloud Products Offered:

• SAP S/4HANA Cloud (Private Edition)
• SAP Business Technology Platform
• SAP Analytics Cloud
• SAP SuccessFactors
• SAP Ariba Solutions
• Digital Supply Chain Solutions

Benefit & Drawback

7. Sovereign Cloud Platform for the Public Sector in Germany

In February 2022, SAP and Arvato Systems announced their plan to invest in a new German company dedicated to providing cloud infrastructure exclusively for the German public sector. This initiative aims to ensure that all data processing and storage for government services remain within Germany, aligning with the German cloud strategy of reducing dependencies on external networks. The new company will operate independently, and all its services will be delivered from within Germany.

Benefits

• Leverages Microsoft Azure’s infrastructure while maintaining a segregated environment, ensuring data remains within the government’s regulatory control.
• Employs a vendor-neutral approach, incorporating open-source software, to offer flexibility and choice for government IT departments.

N.B. It should be noted that since the initial announcement in 2022, there have been few, if any, updates regarding the formation of the new company.

Conclusion

Our exploration of SAP Cloud Data Sovereignty solutions highlights the critical importance of customized approaches in addressing data governance challenges. From considering EU regulations to securing solutions for the UK, US, Australia, and New Zealand, ITAA recognises the strategic importance of data compliance globally.

The solutions discussed offer tools to assist customers with the navigation of data sovereignty complexities in their respective territories. As organizations grapple with data residency and relevant compliance requirements, these products provide strategic solutions tailored to regional requirements.

Here is a quick reference PDF guide for the information above.

If you require assistance with acquiring or assessing the services outlined in this article, ITAA’s SAP Services can aid you in selecting the optimal choice and negotiating favorable terms.