Portugal Approves National Plan For Sovereign Cloud

The government has approved the National Plan For Sovereign Cloud, a strategic instrument designed to strengthen the state's digital sovereignty and ensure greater national control over the data, systems, and critical infrastructure of the public administration.  

Aligned with the priorities of the Programme of the XXV Constitutional Government, the plan forms part of the 2026–2027 Action Plan of the Portugal Digital Strategy, establishing itself as a central pillar in the state's technological modernisation.  

Against a backdrop of growing geopolitical pressure, increasing cyber threats and greater demands across Europe for the resilience of public infrastructure, the approval of the National Plan For Sovereign Cloud is a significant development. In response to these challenges, Portugal is setting out a national framework to protect, manage and host the State’s most sensitive data and systems according to clear sovereignty, security and strategic autonomy criteria. 

A plan developed with the sector 

The National Plan For Sovereign Cloud is the result of a consultation process involving over 100 public and private entities, coordinated by the State Reform Technology Agency. This work enabled a plan to be developed that is tailored to the specific needs of the public administration, the economy, and Portugal’s national technology ecosystem, rather than simply transposing European guidelines.  

The plan adapts the European Cloud Sovereignty Framework to the Portuguese context, establishing a digital sovereignty model that reflects the country's scale, capabilities, and national priorities. 

Three areas of action 

The National Plan For Sovereign Cloud is structured around the following three main areas: 

1. Classification of data and systems:The business processes, data and systems of the public administration will be classified according to criteria relating to sovereignty,security and resilience. This classification will provide the state with a clearer understanding of its digital assets, help to identify different levels of sensitivity, and define the appropriate protection measures. 
2. Requirements by classification level:TheNational Plan For Sovereign Cloud sets out specific technical requirements for each classification level of sovereignty. In practice, this means that the use of public, private or sovereign clouds will depend on the sensitivity of the relevant data and systems, ensuring more consistent, secure and transparent decision-making. 
3. Phased sovereign infrastructure:The plan provides for the gradual implementation of national sovereign cloud infrastructure. This phased approach will strengthen the state's technological autonomy, support Portugal's technology market, and reduce its external dependencies in critical areas.

What changes in practice 

With the National Plan For Sovereign Cloud now in force, the Public Administration has a common framework in place to guide the migration of systems and data to the cloud. This process will no longer be subject to individual bodies making isolated decisions. Instead, a coordinated approach will be taken, based on shared classification criteria and the corresponding security and sovereignty requirements that commercial services and state-owned infrastructure must meet.  

The plan will also accelerate the classification of sovereign data and systems — a crucial step in identifying digital assets that should not be placed under external control. The development of commercial sovereign cloud services alongside the creation of state-owned infrastructure will enable the development of a comprehensive national sovereign cloud offering. This will strengthen the state's ability to protect sensitive information, ensure service continuity, and respond to cyber threats.  

The goal is clear: to provide more efficient, secure and resilient digital public services with greater innovation capacity, while preserving sovereignty over citizens', businesses' and the Public Administration's data.  

The National Plan For Sovereign Cloud is part of the Portugal Digital Strategy's 2026–2027 Action Plan and is linked to the prior authorisation regime for sovereign cloud projects set out in Decree Law No. 85/2026 of 13 April.