Make or buy
Digital sovereignty for SMEs: how to reduce your dependence on Microsoft, US clouds and licence costs
By Dominik Natter · Last updated on 5 November 2026 · 10 min read
In short
For an SME, digital sovereignty means knowing where your data is, being able to get it back in a usable form at any time and being able to switch provider when price or terms no longer fit. For email and Office, the standard cloud is usually the right choice. Independence pays off for core processes, sensitive customer data and software whose licence costs grow with every user. A review before your next contract renewal shows where you stand.
What does digital sovereignty mean for an SME?
Digital sovereignty does not mean running everything yourself. No SME needs its own data centre or mail server. What it means is controlled dependence: you know which providers you rely on, and you have an exit route for the systems that matter.
In practice, it comes down to four questions:
- Data: where is your data, and who can legally access it?
- Access: can you get all of your data back at any time, in a usable format?
- Switching: can you change provider without bringing your business to a halt?
- Cost: who sets the price, and what happens at the next increase?
The topic has reached politics too. On 27 April 2026, the Zurich cantonal parliament referred two postulates to the cantonal government: one for a digital sovereignty strategy and one for securing the canton's IT infrastructure. For an SME the trigger is usually more down to earth: a price increase, a data protection question or a provider discontinuing a product.
- New Microsoft 365 prices, for existing customers from their next renewal
- 1 July 2026
- US list price of Business Standard per user per month, up 12 percent
- USD 12.50 → 14
- Since the US CLOUD Act, storage location no longer decides on data disclosure
- 2018
- From then the EU Data Act bans cloud switching charges for EU customers
- 12 January 2027
Where does dependence get expensive?
Dependence in itself is not a problem. It gets expensive when you can no longer negotiate. These are the most common pressure points:
- Per-user licences: costs grow with every new employee, even though the software stays the same.
- Price increases at renewal: you often learn about them when switching at short notice is no longer realistic.
- Proprietary formats: you can export the data, but only in a form no other system can use.
- Core processes in someone else's software: when the provider changes features, prices or owners, your process changes with it.
- No source code rights: with custom software and no clear rights, only the original developer can carry on.
CLOUD Act and Switzerland: does a Swiss data centre protect against US access?
Not completely. The US CLOUD Act of 2018 requires providers to disclose data in their possession, custody or control, regardless of whether it is stored in the US or abroad. What counts is who controls the provider, not where the server is.
The data protection commissioner of the canton of Zurich, Dominika Blonski, takes the same view. She considers the storage location irrelevant to whether the CLOUD Act applies. What matters, she says, is the group structure: if a group is headquartered in the US, the CLOUD Act applies. Parent company, subsidiaries and subcontractors all need checking.
A Swiss data centre run by a US provider is still not worthless. It helps with availability, speed and data protection obligations. It does not, however, protect against a disclosure order from the US.
How big the risk is for your SME depends on the data. For quotes, project plans and internal correspondence we consider it low. Take a closer look at particularly sensitive personal data such as health data, at professional secrecy in medical, legal or fiduciary work, and at trade secrets your competitive edge depends on. This is our assessment, not a statistic.
Which rule covers what?
| Rule | What it covers | What it means for you |
|---|---|---|
| Swiss Data Protection Act, since 1 September 2023 | Disclosure of personal data abroad | Allowed if the Federal Council recognises the destination country's protection as adequate or if suitable safeguards exist, such as standard data protection clauses |
| Swiss-U.S. Data Privacy Framework, since 15 September 2024 | Transfers to certified US companies | Allowed without additional safeguards. It does not change disclosure obligations under US law |
| US CLOUD Act, since 2018 | Disclosure of data to US authorities | Applies to providers under US control, even when the data is stored in Switzerland |
| EU Data Act, Article 29 | Charges for switching cloud provider | Banned from 12 January 2027, for customers in the EU |
What about the EU Data Act?
The EU Data Act requires cloud providers to make switching to another provider possible. Until 12 January 2027 they may only charge switching fees that do not exceed their direct costs of the switch. From that date they may not charge any switching fees at all.
The rule applies to providers serving customers in the EU. As we understand it, a Swiss SME without a company in the EU cannot rely on it directly. If you have a subsidiary in Germany or Austria, things look different. Either way, the rule is a useful argument in negotiations: what a provider must offer EU customers, it will find hard to refuse you.
Reducing software dependence: the review
Before you change anything, you need an overview. Allow half a day to a full day for it; that is our rule of thumb for an SME with 10 to 50 employees. Ideally do it a few months before your next major contract renewal, while you still have room to manoeuvre.
Six steps to a clear overview
01
List your systems
All software and cloud services with provider, headquarters, annual cost, number of users and contract end date.
02
Critical or not
Which systems carry core processes or customer data? What happens if one is down for a week or the price rises by a third?
03
Test the data export
Export all data from each critical system once. Check that it is complete and that another program can read it.
04
Check the contracts
Data return, format and deadline, deletion, notice period, price adjustments and subcontractors. If something is missing, renegotiate it at renewal.
05
Count your licences
Before every renewal: which licences are in use, which plans are too big, which accounts belong to former employees?
06
Define your exit route
For each critical system: what would the alternative be, how long would a switch take and which data would you need?
Clauses every important contract should contain
With standard software you can rarely negotiate the terms freely. But you should know them before you commit. With custom software and service providers you have more room.
- Data return: which data do you get at the end of the contract, in which format and within what deadline?
- Deletion: does the provider confirm that it deletes the data after returning it?
- Term and termination: how long are you tied in, and does the contract renew automatically?
- Price adjustments: may the provider raise the price during the term, and can you then terminate?
- Headquarters and subcontractors: who is behind the provider, and where is the data processed?
- Source code: with custom software, usage rights and repository access belong in the contract. More on this in the guide «Who owns the source code of custom software? Rights in Switzerland and Liechtenstein».
Where the standard cloud is enough and where independence pays off
The standard cloud is fine for
- Email, calendars, Office documents and video calls
- Accounting and payroll, if a Swiss standard product covers your case
- Systems whose data you can export completely and in an open format
- Anything that works the same in every company and gives you no edge
Independence pays off for
- Core processes that set you apart from competitors, such as costing, scheduling or order processing
- Customer data that is particularly sensitive or subject to professional secrecy
- Your online shop, once revenue and range grow and fees per order or for extensions start to add up
- Software whose cost rises with every user, even though it only covers part of your needs
What are your options?
Run critical applications with a provider headquartered and owned in Switzerland. Swiss law then applies and, as we understand it, the CLOUD Act does not apply directly.
Look at the owners and subcontractors, not just the location of the data centre.
For shops, customer portals or internal applications there are open platforms without licence fees. Your shop could, for example, run on an open shop platform that charges neither per user nor per order.
You pay for development, hosting and maintenance, but not for the right to use the software.
Custom software makes sense where a core process does not fit a standard product. The rights are what matters: source code, documentation and access must be yours, otherwise you are just swapping one dependence for another.
When standard software remains the better choice is covered in the guide «Standard or custom software: how to decide».
Even in a US cloud you can encrypt sensitive data so that only you hold the key. This is often the quickest route when switching is not an option.
Plan who manages the keys and what happens if that person is unavailable.
Sometimes the best option is to stay and prepare an exit route: regular exports, a reviewed contract and an idea of where you would move.
It costs little and strengthens your position in every negotiation.
Cutting licence costs: does your own software pay off?
Sometimes yes, often no. A worked example shows what it depends on. The figures are an example, not a quote.
Suppose your SME uses an industry-specific subscription software for a core process at CHF 60 per user per month, with 20 users. That is CHF 14,400 a year. The alternative is your own solution with around 500 hours of development at CHF 70, so CHF 35,000. On top come maintenance at 15 percent of the development cost, CHF 5,250 a year, and hosting of an assumed CHF 1,200 a year.
Cumulative cost over five years, example with 20 users
+Show values as a table
| Value | Subscription software | Own software |
|---|---|---|
| Year 1 | CHF 14'400 | CHF 41'450 |
| Year 2 | CHF 28'800 | CHF 47'900 |
| Year 3 | CHF 43'200 | CHF 54'350 |
| Year 4 | CHF 57'600 | CHF 60'800 |
| Year 5 | CHF 72'000 | CHF 67'250 |
In this example your own solution only catches up with the subscription in year five. With 10 instead of 20 users, the subscription costs CHF 36,000 over five years while your own solution stays at CHF 67,250. Then the subscription is clearly cheaper. With more users or price increases at renewal, the numbers tip in favour of your own solution sooner.
So cost alone is rarely the main reason. Your own software pays off above all when it fits your process better than the standard product, when it connects several systems or when you need control over data and further development.
Standard software remains the better choice when it covers most of your case, when few people use it or when the provider keeps delivering features you would never build yourself. What maintenance costs to expect with your own software is covered in the guide «Software maintenance costs: what do maintenance and operations cost per year?».
What you do not need to do
Digital sovereignty is no reason to rush. For most SMEs these steps are not necessary:
- Leave Microsoft 365 on principle. For email and Office, the effort of switching usually outweighs the benefit.
- Move all data to Switzerland. Location alone does not solve the CLOUD Act question.
- Encrypt everything. Protect the data where access would really cause harm.
- Replace standard software with your own development just because the price went up. Do the maths first.
Sources and notes
Microsoft 365 and the canton of Zurich
The prices come from Microsoft Licensing's announcement of the Microsoft 365 pricing and packaging changes from 1 July 2026 (US list prices in USD, which may vary by country and currency). The confirmation for Switzerland comes from a Netzwoche report of December 2025. For the canton of Zurich we rely on the bulletin of decisions of the Zurich cantonal parliament of 27 April 2026, KR no. 83/2026 and 84/2026.
Data protection and the CLOUD Act
The CLOUD Act is codified in Title 18 of the United States Code, section 2713. For the Swiss-U.S. Data Privacy Framework we use the Federal Council's press release of 14 August 2024, and for disclosure abroad Article 16 of the Swiss Data Protection Act. The statements by the Zurich data protection commissioner come from an interview in Netzwoche published in December 2025 and January 2026. In Liechtenstein, the EU General Data Protection Regulation applies via the EEA Agreement.
EU Data Act
The information on switching charges comes from Regulation (EU) 2023/2854, Article 29, and on its scope from Article 1(3). The European Commission proposed amendments in November 2025; under that proposal the ban on switching charges from 12 January 2027 would remain. Whether and from when the regulation applies in Liechtenstein via the EEA Agreement is something we have not been able to establish conclusively.
No legal advice
This guide is not legal or tax advice. Please clarify questions on data protection, professional secrecy and contracts with your data protection adviser or a lawyer.
The worked example is an example and does not replace a quote. As of November 2026.
Frequently asked questions
Is data in a Microsoft data centre in Switzerland protected from the CLOUD Act?
Not completely. The US CLOUD Act requires providers under US control to disclose data in their possession or control, regardless of where it is stored. A Swiss data centre helps with availability and data protection obligations, but it does not protect against a disclosure order. What really helps is encryption where only you hold the key.
Do SMEs need to leave Microsoft 365?
No. For email, calendars and Office, Microsoft 365 remains a sensible choice for most SMEs, and switching often costs more than it brings. What matters is knowing which data is stored there, adding protection for particularly sensitive data and checking before every renewal which licences you actually need.
How do we check whether we could switch provider?
With a test export and a look at the contract. Export all of the system's data once and check that it is complete and that another program can read it. The contract should cover data return, format, deadlines, deletion and notice period. If any of this is missing, you know your risk and can renegotiate at the next renewal.
Is custom software cheaper than per-user licences?
Not automatically. With few users a subscription is usually cheaper; with many users and rising prices, your own solution can pay off after a few years. Compare development, maintenance of around 15 percent a year and hosting against licence costs over at least five years. The deciding factor is often not cost but whether the software fits your process and whether you need control over data and source code.
How dependent do we become on Natter Solutions?
As little as possible, and we make sure of that from day one. Every project is documented and handed over so that it can be operated and developed without us: the repository, architecture description, operations manual and access credentials are in your hands.
Does the software vendor have to hand over the source code?
Only if this was agreed or clearly follows from the contract. Neither the Swiss nor the Liechtenstein Copyright Act gives the client a general right to the source code. Set out source code delivery and repository access explicitly in the contract, ideally on an ongoing basis rather than only when the contract ends.
Matching services:Custom softwareE-commerce
Let us talk about your case.
20 minutes are enough to find out whether a custom solution is worth it for you.