British businesses face escalating costs and prohibitive charges to retrieve their data from proprietary storage systems. The UK Government must introduce enforceable data portability rights covering both cloud and on-premises storage to protect companies and their customers from vendor lock-in, argues Ed Accura

I recently spoke with the CIO of a well-known global brand who lost his job over a single but critical miscalculation. He allowed his organisation’s primary data to be held hostage by a proprietary storage architecture.

Licensing fees for tools seemingly included in the initial costs, capacity expansion and other unexpected charges kept pushing the bill higher. When the board demanded a way out, there was no viable migration path and no open exit strategy. The cost of extraction ended up being three to four times the initial budget. He didn’t lose his job due to incompetence but because of a lack of data portability.

This story is a reminder of the ‘leasehold’ economy we’re living in. We are often told that ‘data is our most valuable asset,’ yet we are building our digital lives on land we don’t actually own. This is the reality of ‘vendor lock-in’, a quiet crisis that affects everyone from individual users to the largest global enterprises.

To highlight this issue, I recently created a satirical musical video exploring these frustrations. The performance is tongue-in-cheek, although the problem it depicts has serious consequences.

When you or your company sign up for a cloud service or purchase an on-premises solution hosted on your own site, it often feels like a straightforward investment, but the fine print tells a different story. Many organisations find themselves paying for the same environment over and over again. Between hidden ‘growth taxes’, ambiguous licensing fees, forced upgrades and migration costs, businesses can end up paying several times their original storage investment over the course of a few years.

This trap exists whether you are renting or buying. A simple way to consider it is by analogy with a house, which represents the vendor’s storage solution, and your data, which are the possessions within the house.

If you rely on cloud solutions, it is like moving into a rental home, only to watch the landlord relentlessly raise the rent. When you finally decide to move out, the landlord demands an exorbitant fee just to let you pack up your own belongings.

If you invest in on-premises solutions from some legacy enterprise vendors, it feels like you own the house outright. But when it is time to move, you discover the builder used proprietary locks and demands a fortune in professional services and migration fees just to let you leave. Whether you rent in the cloud or buy on-premises, the cost and complexity of extracting your data can leave your most valuable assets effectively held hostage.

Perhaps the most dangerous part of this model is the lack of transparency. Some enterprise systems are ‘black boxes’ of proprietary software whose inner workings are kept secret by the vendor. We are told to trust that the system is secure, but may have limited means of verifying it ourselves.

If a vulnerability is hidden inside that black box, it can become a ticking time bomb. Where the source code is unavailable for independent inspection, outsiders may have fewer opportunities to identify weaknesses, leaving customers dependent on the vendor’s security processes. If a hacker discovers a hidden back door, they could exploit it for months or even years without customers knowing.

Vendors may counter that their proprietary solutions pass security certifications and compliance audits. Those certifications are important but a periodic assessment is not the same as continued scrutiny. Open-source software can allow independent experts to examine code, identify weaknesses and contribute fixes. That opportunity for scrutiny is valuable, even though openness alone does not guarantee that every vulnerability will be found or patched.

Businesses do not just store financial records, operational information and commercially sensitive data. They also hold enormous quantities of personal information about their customers, employees and suppliers. That can include medical histories, employment records, behavioural data and other highly sensitive details. When an organisation loses control over where that information is stored, how it is accessed or how easily it can be retrieved, the consequences extend well beyond the cost of its IT infrastructure.

Data protection obligations remain with the organisation, regardless of the technology provider it uses. Under the General Data Protection Regulation (GDPR), businesses must be able to respond to requests for personal information to be erased where the right applies. But proprietary storage systems can complicate that responsibility, particularly where data is distributed across inaccessible backups or systems that are difficult to audit. A company may find itself legally accountable for information over which it has limited practical control.

The same dependency can become a problem when a storage provider proposes changing its terms, perhaps to permit new uses of personal information for AI training. Existing data protection laws still apply, but an organisation facing prohibitive migration costs may have little commercial leverage to negotiate or move elsewhere. Vendor lock-in therefore creates a risk extending beyond escalating costs and technical limitations. It can undermine a business’s ability to manage its regulatory obligations, protect confidential information and retain control over one of its most valuable assets.

As we move into a future dominated by AI and digital growth, we have to ask ourselves: are we building equity in our most valuable asset or are we just adding value to someone else’s wealth?

If we cannot move our data, we do not truly own it. It is time to treat data portability not just as a technical feature but as a fundamental right, one that regulations like the GDPR attempt to protect, but which some proprietary architectures can undermine. The danger is becoming a permanent tenant in someone else’s system – one we cannot readily inspect or leave.

This shift toward true data ownership is increasingly reflected in legislation. With the European Union’s Data Act and the broader push for European digital sovereignty, cloud vendor lock-in is being challenged. The legislation addresses switching charges and interoperability for data-processing services, aiming to make it easier for customers to move between providers or bring their data back on-premises. 

However, because this legislation primarily targets ‘as-a-service’ models, organisations investing in traditional proprietary on-premises hardware must remain equally vigilant. For European businesses, adopting open, portable architectures across both cloud and on-premises environments is an essential step towards protecting control over their data.

Had the CIO at the beginning of this story built his foundation on an open-source storage platform with a viable migration path, he would have had greater freedom to negotiate, migrate and protect his organisation’s bottom line. 

True ownership means having the freedom to pack up and leave whenever you choose, rather than watching your most valuable asset become a hostage in someone else’s property.

Ed Accura is an award-winning British filmmaker, producer, recording artist, author, campaigner and expert on data freedom and control. He is the co-founder of the Black Swimming Association, a non-profit organisation promoting diversity and inclusion in aquatics, and the creator of the Blacks Can’t Swim documentary series and Changing the Narrative (2024). His films have been released on platforms including Amazon Prime, Sky, Apple TV and Google Play. Drawing on more than 25 years of commercial experience in the technology sector, Ed also campaigns for greater control over how data is stored, managed and transferred. He writes on data freedom, vendor lock-in, digital dependency, public safety and inclusion, exploring how technology and social change affect businesses and individuals.

READ MORE: A New Year wake-up call on water safety. As a new year begins, Ed Accura challenges one of the most comfortable assumptions we make around water: that someone else is responsible for keeping us alive. Drawing on his work in water safety and inclusion, he argues that survival depends on a shared system of awareness, skills and accountability, with the individual placed firmly at its centre.

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main Image: Sergei Starostin / Pexels}