88% of senior executives at large companies believe a data sovereignty failure could cost them their job, yet 64% of organizations don’t have a formal strategy to control where their data is and who can access it. Those are the headline figures from the Global Data Sovereignty Report 2026, a survey of 2,100 executives across eight countries commissioned by Everpure, formerly Pure Storage, and published on September 30, 2026.
The Everpure data sovereignty report in 20 seconds
- 88% of executives fear losing their job over a data sovereignty failure.
- 64% of companies have no formal strategy.
- Only 9% prioritize protecting against extraterritorial access to their data.
- The study was commissioned by a data management vendor and doesn’t cover Spain.
Consultancy Vanson Bourne ran the survey in June 2026 among executives and IT leaders at large companies in the UK, France, Germany, Australia, Japan, South Korea, Singapore, and India. There’s no data from Spain or the United States. The sector breakdown isn’t known either, nor how many of the 2,100 respondents belong to senior leadership, the group the 88% figure refers to.
High Concern, Low Preparedness
The report describes a clear gap between what executives say they fear and what their companies have actually done. 90% acknowledge data sovereignty as a business issue, and 91% fear financial and reputational damage to their organization if something goes wrong. 85% say they’re willing to give up advanced features to work with a local or sovereign provider, and 40% already limit their use of SaaS services that depend on infrastructure outside their country.
On the preparedness side, the numbers run the other way. 62% lack full visibility into who can access, control, or manage their data. 56% have no plans in place for a foreign power demanding data handover or for service being cut off for geopolitical reasons, and the same share admit they lack the staff and capacity to carry out sovereignty projects. 36% say they struggle to get leadership buy-in.
The most striking figure is another one. Only 9% rank protection against extraterritorial access, meaning data requests backed by other countries’ laws, such as the US CLOUD Act, among their top priorities. That’s precisely one of the risks most discussed in Europe when it comes to who really controls the infrastructure, and it sits oddly alongside the 90% who say they take the issue seriously.
Knowing Where the Data Is Isn’t Enough
Alex McMullan, Everpure’s International CTO, sums it up this way: “Senior executives know their jobs are on the line over data sovereignty, but many are still focused on the wrong risks.” According to McMullan, sovereignty isn’t just about where data is stored, but about having full visibility and control over it, and the key questions are who can access it, which jurisdictions apply, and whether critical data or services could be disrupted.
Rahiel Nasir, research director for digital sovereignty at analyst firm IDC, agrees with that diagnosis: “Digital sovereignty has shifted from a compliance conversation to a critical boardroom concern.” Nasir adds that the challenge lies in controlling all data access and transfers, including metadata, protecting against data requests from other jurisdictions, and managing vendor risk amid geopolitical uncertainty.
Everpure proposes what it calls sovereignty by design: applying controls based on the risk of each data set, application, and workload, and shifting from a notion of national sovereignty to corporate sovereignty, tailored to each company’s risk appetite. The company argues this approach protects critical assets without giving up the scale of major cloud and SaaS providers.
A Study With a Product Behind It
It’s worth reading the report knowing who’s behind it. Everpure, which changed its name from Pure Storage in early 2026 after acquiring data discovery company 1touch, sells exactly the kind of tools used to inventory and classify data. The announcement closes by recommending Everpure Data Intelligence, which discovers and classifies information across its own platform, public clouds, SaaS applications, and third-party storage. The conclusion that visibility is lacking lines up neatly with what the company sells.
That doesn’t invalidate the figures, but it does call for some caution, especially since the announcement doesn’t detail its methodology. For readers in Europe, the study works as a thermometer of a concern that exists there too, where, as this outlet has also reported, growing interest in digital sovereignty still hasn’t translated into familiarity with the alternatives.
Frequently Asked Questions
What does the Global Data Sovereignty Report 2026 say?
That 88% of senior executives surveyed believe a data sovereignty failure could cost them their job, while 64% of companies have no formal sovereignty strategy.
Who conducted the study?
It was commissioned by Everpure, formerly Pure Storage, from consultancy Vanson Bourne, which surveyed 2,100 executives and IT leaders at large companies in June 2026.
Does it include data from Spain?
No. It covers the UK, France, Germany, Australia, Japan, South Korea, Singapore, and India.
What is extraterritorial access to data?
It refers to data requests that a country’s authorities can make to companies under their jurisdiction even if the data is stored elsewhere, as the US CLOUD Act allows. Only 9% of respondents consider it a top priority.
Sources:
