Geo-redundancy in Italy: GDPR, NIS2 and data sovereignty

TL;DR

For DR in Italy in 2026, "European cloud" is no longer enough. NIS2, AgID, the National Strategic Hub and Italian public tenders all push toward Italian sovereign cloud: data, infrastructure and operational staff within national borders. Sefthy was built this way.

What "Italian sovereign cloud" means

Three minimum conditions:

1. datacentres on Italian soil, owned or Italian-operated;
2. Italian operational staff, subject to Italian law;
3. operator ownership not subject to extra-EU jurisdictions (e.g. US CLOUD Act).

Only providers that meet all three conditions truly qualify as "sovereign". Others are "European", which is a GDPR guarantee but not enough for NIS2-public-sector.

Why it matters for DR

In a disaster recovery event, data leaves customer systems. If the DR cloud is extra-EU, the transfer is subject to SCCs and DPIA. If it is EU but operated by a US-controlled entity, there is CLOUD Act risk.

Sovereign cloud eliminates both risks: data stays under Italian jurisdiction by construction.

The 2026 regulatory landscape

GDPR

Defines personal data processing rules. Extra-EU transfer requires SCCs, DPIA, possibly certifications like the EU Cloud Code of Conduct.

NIS2

Article 21 requires supply chain security. For essential entities, using extra-EU providers for critical data becomes a documented risk factor.

AgID and PSN

For the Italian public sector, AgID maintains a list of qualified providers. The National Strategic Hub (PSN) is the new public-sector cloud infrastructure.

CAD (Digital Administration Code)

Defines requirements for public sector systems. Articles 50-bis and following on continuity align with ISO 22301.

What to ask a DR provider

Five direct questions:

1. Where are the datacentres physically?
2. Who controls the operating company?
3. Are there extra-EU sub-suppliers?
4. Which certifications: ISO 27001, 27017, 27018, 9001?
5. AgID qualification or equivalent?

Without clear answers to all five, it is not sovereign cloud.

Sefthy: Italian cloud by construction

Sefthy has three Italian datacentres, Italian operational staff, Italian company, full certifications (ISO 27001:2022, 27017:2015, 27018:2019, 9001:2015). For Italian NIS2 entities it is a natural fit.

FAQ

Is "European cloud" not enough?

For Italian public sector and NIS2 essential entities, no. For ordinary SMBs it satisfies GDPR but is sub-optimal for NIS2 supply chain.

Can I use a non-Italian cloud and claim NIS2 compliance?

Yes, but with extra DPIA and documented supply chain risk management. More paperwork.

Does sovereignty affect latency?

Positively. Latencies between Italian sites are in the 5-15 ms range. To European datacentres (Dublin, Frankfurt): 25-50 ms.

For cloud vs on-prem comparison, Cloud DR vs on-prem. For certifications in public tenders, Certifications and public tenders.