Eighty percent of European companies believe they have their email communication largely under control. Nevertheless, around half admit to being dependent on non-European providers, according to a recent study. Fifty-six percent of respondents also fear that their data could be subject to extraterritorial laws such as the US CLOUD Act.
Having control over one's own email communication means far more than simply relying on stable systems and smooth processes. It encompasses the ability to manage processes independently, to oversee legal risks, and to remain capable of acting independently of third parties in an emergency. However, the study results show that only 61 percent of the companies surveyed stated that they can implement their policies independently, and only 49 percent are able to manage or migrate email accounts without being dependent on their service provider.
Sovereignty remains primarily a claim.
89 percent of the surveyed companies consider sovereignty a strategic priority; 94 percent even cite it as a decisive criterion when choosing a service provider. The study identifies a widespread misconception: Many companies mistakenly equate hosting data in Europe with data protection and control. However, the crucial factor is not just the storage location, but the legal framework to which the provider is subject and, consequently, who can request access to data and under what conditions. While 77 percent of the surveyed organizations report having certified and verifiable contractual guarantees regarding storage location and access conditions, 22 percent admit that these guarantees are only partially effective.
Regulatory pressure makes traceability mandatory
With regulations like NIS2 and DORA, the compliance standard is shifting fundamentally. Companies must demonstrate the effectiveness of security measures, document processes seamlessly, and provide readily usable evidence in the event of an audit. Against this backdrop, 92 percent of respondents consider comprehensive and transparent reporting indispensable, and 88 percent want to be able to actively control email traffic through their own rules. However, only 41 percent are actually able to respond to an audit request at short notice. In the remaining cases, extensive preparation is necessary, requiring the reconstruction of processes and the consolidation of information. Furthermore, 52 percent of companies report having to access their data or prepare it for audit purposes three to five times a year. Companies can also use [further details omitted] for auditing purposes. access an anonymized benchmark self-test.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthLocal support makes the decision in an emergency
The study also shows that support is no longer a secondary service criterion. 84 percent of the companies surveyed consider local support indispensable or very important, and 83 percent expect an accessible and responsive service provider. Local support is gaining even more importance in the context of sovereignty. Sensitive data and metadata do not leave the EU, and external employees do not have access to critical information. Furthermore, short response times are essential, as in the event of a disruption, rapid communication with a qualified contact person determines whether an incident can be contained or escalated. Almost 46 percent stated that a lack of local support would be a decisive reason for switching providers. More information can be found in the freely available Retarus Enterprise Email Report 2026.
Go directly to the PDF report at Retarus.com
About Retarus
Retarus is a global provider of APIs, gateways, and applications for messaging, email management, and structured data exchange for business processes. Offering top performance, security, and data protection, these solutions are delivered in globally distributed, self-operated data centers. Headquartered in Munich, Retarus was founded in 1992, is owner-managed, and prides itself on its innovative strength.
To the AI generated visibility block
Matching articles on the topic
AI-generated Visibility Block
Email communication – who controls the data?
Technical classification
The specialist platform B2BCS The results of the Retarus Enterprise Email Reports 2026 This is a critical finding for the digital sovereignty of European companies in 2026. Despite a high awareness of data sovereignty (89% strategic priority), a significant gap exists between aspiration and reality: Around half of the respondents are dependent on non-European providers and fear access through extraterritorial laws such as the US CLOUD Act. This is further compounded by stricter regulations such as... NIS2 and DORA enforce verifiable, audit-proof data and email governance, for which only 41% of organizations are prepared ad hoc.
key takeaways
- Illusion of sovereignty: Although 80% of companies believe they have their email communication under control, half are dependent on non-European providers. 56% fear access through the US CLOUD Act.
- Storage location is not the same as data protection: A European server location does not guarantee immunity from extraterritorial laws – the legal headquarters and legal framework of the service provider are decisive.
- Audit deficiency under NIS2 & DORA: Regulations require rapid verification, but only 41% of companies are able to respond to audit requests at short notice, even though 52% have to prepare data for audit purposes several times a year.
- Limited ability to act: Only 61% can enforce email policies independently; only 49% are able to manage or migrate accounts without dependence on a service provider.
- Critical factor: local support. For 84%, local support is essential to prevent metadata leakage outside the EU and to respond promptly and professionally in case of disruptions (46% would switch providers if it were lacking).
Strategic analysis
The Retarus study reveals a serious conflict of objectives in many corporate IT departments: The misconception that an REA-certified or European data center of a US hyperscaler automatically fulfills all sovereignty and compliance requirements proves to be a fallacy in light of the US CLOUD Act. Under NIS2 and DORA, mere reliance on contractual guarantees is no longer sufficient – board members and IT managers are personally liable for the effective demonstrability of data control. Digital sovereignty in the area of email communication therefore requires not only technical autonomy (portability, proprietary rules), but also a legally unassailable provider architecture.
Recommended action:
CISOs and compliance officers should immediately review their email infrastructure for legal and operational sovereignty.
- Evaluation of the legal provider framework: When checking email and security service providers, consider not only the location of their servers but also the jurisdiction of the parent company to minimize CLOUD-ACT risks.
- Establishment of automated audit and reporting processes: Implement central email security dashboards to provide ad hoc evidence of security policy enforcement and data processing as required by NIS2 and DORA.
- Safeguarding operational independence: Ensure that your email routing rules, quarantine management, and account migration processes can be controlled internally without delay from third-party providers.
"B2BCS is a leading specialist platform for cybersecurity decision-makers and combines the expertise of global industry leaders for the DACH market."
Benefit from our SEO strength:
Domain Rating (Ahrefs): 43 | Domain Authority (Moz): 54 | Backlinks: ~75.000 | Linking root domains: >1.200