Taking what it says is a unique approach to addressing the compliance needs of organizations in the European Union, Oracle Corp. today launched dedicated cloud infrastructure exclusively for use by the 27 EU member countries, providing the same services, service-level agreements and pricing as its broader public cloud.

The EU Sovereign Cloud, which will be available in July, is located entirely within the EU, supported by EU-based personnel and operated by Oracle-owned legal entities incorporated within the EU. It’s available initially from data centers in Frankfurt and Madrid, although other regions may be added in the future.

Oracle said the service enables businesses with data and applications that are sensitive, regulated or of strategic regional importance, as well as workloads that fall under EU privacy requirements such as the General Data Protection Regulation, to move to the cloud without the risk of violating EU laws. It provides policies and governance practices that allow customers to demonstrate adherence to regional and industry regulations and to comply with EU monitoring laws that regulate data transfers out of the region.

Penalties can be severe

Noting that Meta Platforms Inc. was fined $1.3 billion last month for transferring customer data out of the EU, Oracle Vice President Of Products and Strategy Leo Leung said the offering meets an important need. The Meta penalty “is a good example of what can happen if a company doesn’t pay attention or ignores the regulations around data,” he said.

The EU Sovereign Cloud is the industry’s only offering that is physically and logically separate from other cloud regions and is dedicated to EU customers, Leung said. “It has all the same commercial cloud services so there’s no penalty for running it,” he said. “It has been designed to protect against data being taken outside of the EU.”

Oracle expects the offering to appeal to government agencies and heavily regulated industries like financial services, healthcare and telecommunications. “It’s a pretty large part of the market,” Leung said. Customer Vodafone Group plc, for example, has deployed six dedicated regions in three countries “to try to address the different standards that exist at the EU level and in some cases at the country level,” Leung said.

Logically and physically separate

Although the EU Sovereign Cloud is connected to the internet, there are no direct connections to Oracle Cloud Infrastructure. The company will continue to operate its existing commercial regions in the EU. All services that are currently available across OCI will also be part of the sovereign cloud, although not at launch. “It will take a little bit of time to move our Fusion applications into the environment, but the plan is to support our Oracle cloud applications inside these regions,” Leung said.

In concert with the launch, Oracle is introducing two new key management services that are available across its entire cloud. OCI External Key Management lets customers encrypt data using keys that are created and managed by the customer outside of OCI and that stay within the customer’s custody. OCI Dedicated Key Management is a dedicated, single-tenant hardware security module provisioned within OCI that is managed solely by the customer.

Building the service was no small feat, Leung said. Other cloud providers have tried options such as creating local partitions within their public cloud regions or relying on partners but “they don’t have anywhere near the range of services available, such as analytics,” he said. “If you have data in the EU and you need to keep it in the EU, you need analytics.”

Companies that want to use the sovereign cloud will find some tradeoffs. Any applications and data they are currently using in the public cloud will need to be migrated. “They will have to migrate their environments because they are separate and we’ll define a process for them to do that,” Leung said. “Part of the tradeoff of being entirely separate is that it requires a full migration process.”

However, he noted that large enterprises typically run multiple deployments of mission-critical applications like enterprise resource planning in discrete geographic regions. “In some ways, this will be nothing new for a lot of those companies,” he said.

Image: European Union