European data sovereignty: the next step we've been building toward

In the years before even GDPR came into force, Neil Cawse and I sat down over breakfast and made a decision that most people in our industry weren't thinking about yet. We were going to move Geotab's European customer data to European infrastructure. Not because regulators required it, but because it was the right thing to do for the customers who trusted us with their operations.

Approximately two years later, GDPR came into force and we were ready.

That decision was an early expression of something we now call privacy by design: the idea that data protection isn't a compliance layer bolted on after the fact, but a principle built into how a product is architected from the start. We have been GDPR compliant for close to a decade. That is what building it in from the start looks like.

Sovereignty by design is the next step, and a harder one.

At Connect Europe in Barcelona in May, I moderated a conversation between Neil and Dr. Luc Julia, co-creator of Siri, former Chief Scientific Officer at Renault. Luc said something that stayed with me: you cannot be sovereign if you don't have all the layers. The cloud middleware is American. For European organisations trying to keep data genuinely within European jurisdiction, the geography of a server is only one part of a much harder problem.

He was talking about AI infrastructure. Connected vehicles and fleet intelligence are no different.

The data sovereignty question being asked of vendors across European fleet procurement today is a legitimate one. Where is my data? Who can reach it? Under what law? These are questions with specific, answerable answers, and they depend on legal structure as much as server location. Geotab is a Canadian company. We invest actively in the United States and in Europe. Our structure means we can operate across both with integrity. All European customer contracts run through our Canadian or European entities, and the US CLOUD Act does not apply to Canadian entities as it does to US-incorporated companies. That is a legal fact, not a political statement.

We have been in Europe for more than a decade. Europe was the first market we expanded to outside North America — 12 offices across 8 countries, two R&D centres, and more than one million connected vehicle subscriptions in EMEA. Neil said it himself at Connect Europe: “We did not arrive here recently. We built here, from the ground up.”

The next layer is the infrastructure itself. Over the past year, Geotab has been working closely with European cloud providers on a technical evaluation. We have selected a preferred partner and the work is already underway. Testing infrastructure will be available this year to customers and a partnership announcement will follow as all formalities are finalised.

This is sovereignty by design: the same principled, proactive approach that put us ahead of GDPR in 2018, applied to the infrastructure question European customers are asking us to answer today. It sits alongside privacy by design and security by design as the third pillar of how Geotab approaches data, built on a commitment made long before this became a competitive talking point.

The great ice hockey legend, Wayne Gretzky said he skated to where the puck was going, not where it had been. As Canadians who grew up playing or watching hockey, that is the only way we know how to build. We moved data to European infrastructure before regulators required it. Sovereignty by design is the next skate.

For organisations with the strictest data residency requirements, the ones that need their operational data within European jurisdiction, processed under European law: this is already underway.

Our read of the market is that the organisations treating data sovereignty as a structural question now will be the ones others benchmark against in five years. We made the call before the market asked the question. We are making it again. Stay tuned.