Data sovereignty is a simple idea wrapped in confusing language. Stripped down, it means this: the data your WordPress site collects should sit under a legal system you trust, and stay out of reach of foreign laws you did not agree to. For a Swedish site that usually means keeping personal data inside the EU, on infrastructure run by a company that cannot be quietly compelled to hand it over. This post explains what the term actually covers, why “the server is in Europe” is not the whole answer, and how to reason about it for your own site.
Sovereignty is about jurisdiction, not just geography
People hear “data sovereignty” and picture a map: a server in Sweden good, a server in the United States bad. Location matters, but it is only half the story. The other half is jurisdiction, meaning which country’s courts and agencies can lawfully order the data to be produced. A data centre in Frankfurt owned and operated by a US company is physically in the EU, yet the company running it can still be subject to US legal orders. Geography tells you where the bytes rest. Jurisdiction tells you who can compel their disclosure. Sovereignty is the combination of the two.
That distinction is why the same question can have a comfortable answer and an uncomfortable answer at the same time. Your host may truthfully say “your data never leaves the EU” while the company that owns the host answers to a legal system on another continent. Both statements can be true. Only one of them is about sovereignty.
What “personal data” means for a normal WordPress site
You do not need a login wall or a checkout to be handling personal data. A default WordPress install already touches more than most owners realise. Comment forms store names, email addresses and IP addresses. Contact form plugins email submissions and often log them in the database. Server access logs record visitor IP addresses. Analytics, embedded fonts, maps and video players can send visitor data to third parties the moment a page loads. Under the GDPR, an IP address is personal data. So the question is not “do I collect personal data”, it is “where does all of it end up, and who can reach it there”.
- The hosting path: where WordPress core, your database, uploads and backups live.
- The plugin path: form submissions, comments, orders and the services those plugins call.
- The front-end path: fonts, analytics, embeds and tag managers that run in the visitor’s browser.
- The peripheral path: the tools your host or agency uses to run the business, such as chat, email and payments.
Sovereignty is strongest when the first path, the hosting path, is fully inside a jurisdiction you trust. That is the path that holds the database, the backups and everything a compromise or a legal order would expose at once. The other paths matter too, but they are the ones you can usually swap, restrict or switch off. The hosting path is the foundation, so it is the one to get right first.
Why Swedish and EU owners are asking the question now
Three things pushed this from a niche legal worry into a mainstream one. First, the Court of Justice of the European Union struck down the EU-US Privacy Shield in its 2020 Schrems II ruling, which forced everyone to look harder at transfers to the United States. Second, the US CLOUD Act made explicit that US providers can be ordered to produce data they control, wherever in the world it is stored. Third, Swedish public bodies and their advisers began treating “who ultimately controls this data” as a procurement question, not a technicality. If your clients include the public sector, healthcare, finance or law, that scrutiny flows down to you.
None of this means a US-owned service is illegal to use. It means the burden of proof has shifted. You are now expected to know where your data lives, who controls the companies handling it, and what legal mechanism covers any transfer outside the EU. “We never really thought about it” is no longer a comfortable place to stand.
Geography tells you where the data rests. Jurisdiction tells you who can compel it. Sovereignty is having a good answer to both.
A practical way to reason about your own site
You do not need to become a lawyer to get this mostly right. Start by separating the hosting path from everything else, because that is where the concentrated risk sits. Ask your host two plain questions: where is my data physically processed and stored, and which company, in which country, ultimately owns and controls the infrastructure. A host with nothing to hide will answer both in one email. If the answer to the second question is a US parent company, your EU-stored data may still be reachable under US law, and you should decide whether that is acceptable for the data you hold.
Then look at the paths you control. Self-host fonts instead of loading them from a third party. Prefer privacy-friendly, EU-based analytics or none at all. Check what your form and comment plugins do with submissions. For the peripheral tools that a host or agency uses to run its business, such as a support chat or a payment processor, the honest standard is not “zero foreign tools anywhere”. It is that no personal data from your visitors flows through those peripheral tools into a jurisdiction you were trying to avoid. Keep the hosting path clean, keep visitor data out of the peripheral path, and you have covered the parts that matter most.
How Celestio approaches it
We built Celestio so the hosting path is Swedish by construction. Sites run on our own infrastructure in Falkenberg, Sweden, on renewable-powered GleSYS hardware, and customer site data is processed inside the EU. There is no US cloud in the hosting path. We are also honest about the edges: like most companies we use a small number of peripheral tools to run the business, and our Data Processing Agreement lists them plainly rather than pretending they do not exist. The point of sovereignty is not marketing purity, it is a clear, defensible answer to “where is my data and who can reach it”. Our cloud sovereignty page shows exactly how we set that up, and our managed WordPress service keeps it that way over time.
This is practical guidance, not legal advice. For decisions about your specific obligations, consult your DPO or legal counsel.