Zero Trust Architecture and Data Sovereignty. A comparative analysis of Romania and Italy

Zero Trust Architecture (ZTA) and data sovereignty have become central pillars of governmental information technology (IT) strategies. In the constantly evolving landscape of the European Union (EU) digital market, challenged by cyber threats an geopolitical tensions around technological control. However, due to a lack of long-term vision, these frameworks can sometimes be misapplied. In parallel, data sovereignty has gained increasing relevance due to states’ growing reliance on global providers of digital infrastructure, further amplified by the rise of sovereigntist discourse across Europe. Significant risks raised out of this dependency: the potential loss of control over data, exposure to extraterritorial jurisdictions, power imbalances between users and providers, and potential ethical and democratic consequences. This paper offers a comparative analysis of Romania and Italy, examining how each country addresses challenges related to digital security and data sovereignty. It proposes recommendations for coherent European digital governance, in alignment with initiatives such as GAIA-X, and seeks to identify mechanisms by which member states can balance innovation, security, and strategic autonomy. As our data show, Romania has begun implementing Zero Trust principles in public administration, aligning with EU and ENISA standards, while Italy has recently rejected collaboration with the Starlink network, citing risks to national control over governmental communications. This decision reinforces the urgency of achieving real digital autonomy within EU.