Regulating the cloud: Cross-border data transfer regulation and the geography of hyperscale cloud infrastructure

Thumbnail Image

Files

master_Ngo_Linh_2026.pdf (2.05 MB)

URL

Journal Title

Journal ISSN

Volume Title

School of Science | Master's thesis
Unless otherwise stated, all rights belong to the author. You may download, display and print this publication for Your own personal use. Commercial use is prohibited.

Authors

Date

2025-12-31

Department

Major/Subject

Computer Science

Mcode

Degree programme

Master's Programme in Computer, Communication and Information Sciences
Master's Programme in Computer, Communication and Information Sciences
Master's Programme in Computer, Communication and Information Sciences

Language

en

Pages

53

Series

Abstract

Cloud computing has become a central component of digital economic activity and depends on infrastructure that operates across national borders. As data are stored, processed, and accessed through globally distributed systems, cross-border data flows have become a routine feature of cloud-based services used by firms, governments, and individuals. At the same time, the growing concentration of cloud infrastructure among a small number of global providers has raised questions about regulatory reach, jurisdictional control, and economic dependence. These concerns have brought issues of digital sovereignty into debates on data governance and industrial policy. In response, governments increasingly rely on cross-border data transfer (CBDT) regulation to shape data flows, influence cloud market development, and manage reliance on foreign-controlled infrastructure. This thesis examines whether stricter CBDT regulation is associated with changes in the geographic expansion of hyperscale cloud infrastructure. In this study, stricter regulation refers to CBDT regimes that exceed GDPR requirements by imposing additional legal conditions on cross-border data transfers. To address this question, the analysis adopts a cross-national empirical design that combines country–year data on new hyperscale cloud availability zone announcements with systematic information on the timing and restrictiveness of CBDT regimes. Exploiting variation in the adoption of GDPR-equivalent or stricter CBDT frameworks across countries, the study applies an interaction-weighted difference-in-differences event-study design to examine infrastructure deployment patterns before and after regulatory adoption and to estimate regulatory effects under standard identifying assumptions. The results show no evidence that the adoption of stricter CBDT regimes leads to increased hyperscale cloud infrastructure deployment, either in the full sample or within subsamples of middle- and high-income economies and the largest economies. This finding suggests that regulatory tightening alone does not substantially affect the factors that shape hyperscale infrastructure siting decisions. Instead, infrastructure deployment appears to be driven primarily by structural considerations—such as energy availability, economies of scale, and existing network configurations—and by providers’ ability to comply with CBDT requirements through legal and organizational adjustments rather than physical relocation. From the perspective of digital sovereignty, the results point to a gap between regulatory intent and infrastructure outcomes, indicating that CBDT regulation may need to be complemented by broader approaches that address infrastructural dependence and market concentration more directly.

Description

Supervisor

Lehdonvirta, Vili

Thesis advisor

Kässi, Otto

Keywords

cloud computing, hyperscale cloud infrastructure, cross-border data transfer regulation, digital sovereignty, digital sovereignty, event-study difference-in-differences

Other note

Citation

Permanent link to this item

https://urn.fi/URN:NBN:fi:aalto-202601221897

Collections

[dipl] Perustieteiden korkeakoulu / SCI