The French government is pulling its national Health Data Hub off Microsoft Azure and moving it to Scaleway, a subsidiary of French telecom group Iliad. The decision, first reported by VoIP Review, puts a concrete deadline on the migration—late 2026 or early 2027—and marks one of the most significant public-sector tests yet for Europe’s push toward digital sovereignty.

What changed

The Health Data Hub, which gives approved researchers a secure environment to work with sensitive medical records, has been running on Azure since 2019. That original choice never went through a competitive tender, sparking years of criticism from privacy advocates and lawmakers who warned that hosting French health data with a U.S. company exposed it to foreign legal risk.

Now, after a formal selection process, Scaleway has won the contract. The company already holds the mandatory HDS (health data hosting) certification and is working toward SecNumCloud, a French security qualification that guarantees immunity from extraterritorial laws such as the U.S. CLOUD Act. Scaleway will not merely provide raw infrastructure; its 2025 acquisition of DataOps specialist Saagie signals an ambition to offer the fuller data management, quality, and analytics tooling that modern health research demands.

Concretely, the platform will host a duplicate of the National Health Data System (SNDS)—a sprawling repository of reimbursements, hospital stays, prescriptions, and care pathways—alongside other curated datasets. The goal is to let French and European researchers query and combine these records under strict access controls, without depending on a hyperscaler whose corporate parent answers to American courts.

What it means for you

For French citizens

Your medical data will be governed entirely under French and EU law if you ever become part of a research dataset. That does not erase all privacy risks, but it removes one persistent worry: that U.S. authorities could compel a cloud provider to hand over information. Whether this builds public trust depends on transparency. Citizens should look for plain-language explanations of who accesses the data, for what purpose, and under what oversight. If the government pairs the hosting change with stronger governance and auditability, confidence could rise; if not, sovereignty branding alone will not convince sceptics.

For researchers and health professionals

Expect some operational friction during the cutover. Workflows built around Azure-native services may need rebuilding, and not every feature will have an immediate Scaleway equivalent. On the upside, the platform’s DataOps capabilities could make messy health datasets easier to prepare and analyze. Researchers should stay in close contact with HDH project managers about timelines, training, and any temporary restrictions on access. The migration window through early 2027 is aggressive enough to keep pressure on, but a rushed transition could disrupt ongoing studies.

For IT leaders and cloud buyers across Europe

The HDH migration is not just a French curiosity. Banks, insurers, hospitals, and critical-infrastructure operators are watching. If Scaleway delivers a stable, well-governed platform, it will embolden other public bodies to set sovereignty as a hard requirement—not just a nice-to-have—in cloud tenders. Practically, your next step should be to classify your organization’s datasets by sensitivity and regulatory exposure. For the most sensitive workloads, begin exploring European alternatives now, and bake exit plans into any future hyperscaler contracts. Sovereign compliance is becoming an architectural question, not a checkbox.

For Microsoft and the broader cloud market

This loss stings more for its symbolism than its revenue impact. Microsoft has invested heavily in European data boundaries and sovereign cloud partnerships, but the HDH saga shows that some governments want more than local disk; they want providers whose ownership, governance, and ultimate legal obligations are anchored on the continent. In response, hyperscalers will likely push even harder on sovereign SKUs and regional red lines. The market is not about to abandon Azure or AWS overnight, but we may see a segmentation where routine workloads stay with the giants while the most sensitive data shifts to European operators.

How we got here

The backstory is a timeline of growing transatlantic tension over data control:

  • 2019 – Microsoft Azure is selected to host the HDH without a competitive tender, setting off privacy alarms.
  • 2020–2022 – The CLOUD Act and evolving GDPR enforcement deepen legal concerns. French authorities face pressure to rethink the arrangement, even as COVID-19 accelerates demand for health data analysis.
  • 2023–2024 – France and the EU sharpen procurement rules that penalize dependence on foreign technology. Germany’s Schleswig-Holstein begins its own open-source divorce from Microsoft, and Denmark follows suit.
  • 2025 – Scaleway acquires Saagie, beefing up its data orchestration chops. The French government launches a competitive tender with hundreds of technical criteria.
  • 2026 – Scaleway wins. Migration planning begins in earnest, with the operational cutover targeted for late 2026 or early 2027.

This sequence is important because it shows a deliberate pivot: from accepting a practical shortcut during a health emergency to treating cloud sovereignty as a permanent pillar of public policy.

What to do now

If your organization handles sensitive data, act before you are forced to by regulation or contract expiry:

  1. Map your sensitivity. Inventory every dataset, classify it by jurisdiction, regulatory exposure, and the consequences of foreign access.
  2. Separate workloads. Identify which applications can stay on a hyperscaler and which should move to a sovereign provider. Not everything needs to shift.
  3. Test portability. Run a pilot with a European cloud on a low-risk dataset. Validate performance, just as the HDH team will be doing over the next 18 months.
  4. Review contracts. Negotiate exit rights, data egress terms, and ownership of metadata before you sign or renew. Once you are deeply embedded in proprietary services, migration becomes exponentially more expensive.
  5. Fund training. Your teams will need new skills. Budget for learning sovereign-specific APIs, identity systems, and monitoring tools.

For ordinary consumers, the best immediate action is to stay informed. When your government publishes access logs or audit reports on the HDH, read them. Public scrutiny is what turns a sovereignty label into genuine accountability.

What to watch next

The migration project itself is the first milestone. Look for detailed progress updates, independent security audits, and concrete reports from researchers on whether the new platform meets their needs. Scaleway’s SecNumCloud qualification timeline will be just as critical; without it, the sovereignty argument loses teeth.

Broader European adoption will be the real verdict. If other nations follow with similar tenders for health, defence, or justice data, the HDH will become a reference architecture. If Scaleway stumbles—performance gaps, downtime, or a researcher revolt—critics will pounce. The outcome will either validate or undercut the entire premise that Europe can build competitive, trustworthy cloud infrastructure on its own terms. Either way, Windows watchers should keep an eye on the ripple effects: Microsoft will almost certainly refine its sovereign cloud story in response, and every European public-sector IT buyer will be taking notes.