Digital sovereignty for the public sector: what Cyso and xxllnc will show at Data Expo 2026
By Alec on
Around 341 Dutch municipalities run on cloud services owned in the United States. For a sector that holds some of the most sensitive data about citizens, that is a lot of trust placed in providers governed by another country's laws. It's the kind of dependency that stays invisible right up until the moment it matters.
On 9 and 10 September 2026, Cyso is at Data Expo in the Jaarbeurs Utrecht to talk about what public organisations can actually do about it. Not in theory, and not all at once, but step by step. You'll find us at stand 133 on both days.
The talk: digital sovereignty without the big rebuild
The centrepiece is a joint session with xxllnc on Wednesday 9 September, 10:15 to 10:45, in room 1.
"Digital autonomy for the public sector: no big bang, just a realistic path."
Because Data Expo asks the customer to lead, the session is presented by Michel Veenhuis and André Lino of xxllnc, with Tjebbe de Winter from Cyso joining on stage for the network and infrastructure context. It runs as a 20-minute talk followed by 10 minutes of questions, in English, so international specialists working in the Netherlands can follow along.
One idea holds it together: digital sovereignty is a sequence of sensible moves, and each one has to earn its place before the next begins.
Three steps that make data sovereignty practical
The session walks through the same path Cyso uses with customers.
First, see where you stand. Which systems matter, who runs them, and which country your data actually sits in. Most organisations have never mapped this properly, and the exercise alone tends to surface a few surprises.
Second, move what makes sense to European cloud. You don't migrate everything on day one. You start with the workloads where the case is clear, such as an application that anonymises documents, and leave the rest running while your team learns. xxllnc has done exactly this, shifting sensitive workloads off AWS to keep them under European control.
Third, build on open standards so your options stay open. Sticking to widely used technology like Postgres means you can move between providers later without unpicking everything you built. That is the real defence against vendor lock-in, a phrase plenty of people search for and very few enjoy living with.
Managed service, or just "as a service"?
One distinction our co-owner Tjebbe de Winter keeps returning to: the gap between an "as-a-service" product and a genuinely managed service. Hyperscalers hand you powerful automated tools, but you still need deep in-house knowledge to run them safely. A managed service moves that operational weight onto the provider. For a public body without a large platform team, that difference decides whether sovereignty is realistic or stays a slide in a deck.
Who the session is for
The room is built for a mix. Data engineers and operational staff get the technical specifics on setup and migration, while strategic decision-makers get the bigger picture on risk, compliance and where European hosting fits. The scope reaches past municipalities into the wider public sector and regulated fields like banking and healthcare, where the questions about control and data sovereignty look much the same.
Come and continue the conversation
After the talk, walk over to stand 133. We'll have people who can get into your specific setup, and a white paper on sovereignty and AI you can take away by scanning a QR code at the end of the session.
Data Expo is the largest data and AI event in the Netherlands, co-located with the Cybersecurity Expo, and entry is free with an exhibitor ticket.
Get your free ticketSee you on 9 and 10 September. Stand 133, Jaarbeurs Utrecht, 10:00 to 17:00.
