- The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US law passed in March 2018.
- It allows US authorities to require a provider subject to their jurisdiction to hand over data stored anywhere in the world.
- Any company with an ownership or operational link to the United States is concerned, including for European customers.
- Mitigation mechanisms exist: BYOK, application-level encryption, sovereign partnerships (Bleu, S3NS), strict residency with an EU operator.
What is the CLOUD Act?
The CLOUD Act, short for Clarifying Lawful Overseas Use of Data Act, is a US federal law passed on 23 March 2018 as part of the Consolidated Appropriations Act. It amends the Stored Communications Act of 1986 to clarify the geographical scope of orders served on providers of electronic communication services.
In practice, the law asserts two principles. First, a provider subject to US jurisdiction must produce the data in its possession, custody or control, regardless of where that data is physically stored. Second, the US government may sign bilateral executive agreements with third countries to facilitate cross-border requests, provided equivalent legal safeguards are in place.
The reach of the CLOUD Act is therefore not limited to companies based in the United States. Any entity with a sufficient operational or ownership connection, for example a subsidiary active on the US market, may be served with such an order.
From the Microsoft case to the law as passed
- December 2013Microsoft refuses to hand over emails stored in Ireland to US courts. This marks the start of a legal battle that will go all the way to the Supreme Court.
- February 2018Hearing before the US Supreme Court in United States v. Microsoft Corp.
- 23 March 2018Congress passes the CLOUD Act within a budget bill (Consolidated Appropriations Act). The Supreme Court declares the Microsoft case moot.
- 2019First CLOUD Act executive agreement signed with the United Kingdom.
- 2022Talks open between the United States and the European Union on a possible CLOUD Act framework agreement, with no outcome to date.
What it changes for a European organisation
Six tangible consequences observed in the legal, procurement and architecture departments of large European organisations since 2018.
Data accessible outside the EU
A US warrant can target data hosted in a French data centre operated by the European subsidiary of a US group. Physical location alone no longer creates a legal barrier.
No notice to the customer
The procedure may come with a gag order forbidding the provider from informing its customer of the request. The European customer may remain unaware for a long time that a transfer has taken place.
Conflict with the GDPR
Transferring personal data outside the EU without a GDPR legal basis exposes the organisation to sanctions from the CNIL. The CLOUD Act potentially creates a conflict of laws for the providers concerned.
Contract clauses to review
The terms and conditions of most hyperscalers now include a CLOUD Act clause. Public contracts and contracts with operators of vital importance (OIV) must respond with stronger notification and residency commitments.
Cost of compliance
For regulated sectors (health, finance, defence), assessing and then managing CLOUD Act exposure takes up the time of lawyers, architects and procurement teams. This cost weighs on the real TCO of the solutions concerned.
Reputational effect
In European public tenders, CLOUD Act exposure is becoming a decisive criterion. Several administrations now require a certificate of immunity or hosting with a SecNumCloud operator.
Three common confusions
“My data is in an EU region, so I am protected.”
The cloud region refers to the physical location. It does not change the provider's jurisdiction. If the parent company is American, the CLOUD Act applies.
“My provider's managed encryption protects me.”
If the provider holds or can access the keys, it can be compelled to decrypt. Only BYOK with an external HSM or client-side application encryption offers a technical guarantee.
“The CLOUD Act has never been used against European data.”
Requests are confidential by design and often accompanied by a gag order. The official statistics published by providers (transparency reports) show a significant volume of US requests, with no breakdown by the end customer's jurisdiction.
What you need to know in 5 questions
What is the CLOUD Act?
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law passed on 23 March 2018. It allows US authorities to require a provider subject to their jurisdiction to hand over data stored abroad, under certain conditions.
Does the CLOUD Act apply in Europe?
Indirectly, yes. Any provider with an operational or ownership connection to the United States may be concerned, including its European subsidiaries. The physical location of data in Europe therefore does not, on its own, create a legal barrier.
Which companies are concerned?
All entities subject to US law: US companies (AWS, Microsoft, Google), integrated European subsidiaries of US groups, and their subcontractors. Purely European players with no US capital or operations are not covered.
How can you protect yourself from the CLOUD Act?
There are several levers: choosing a European provider under European control, using a regulated partnership (Bleu, S3NS) with SecNumCloud qualification, deploying BYOK or HYOK with an external HSM, or encrypting client-side before sending anything to an exposed service. The right combination of measures depends on the level of sensitivity.
Does the GDPR protect against the CLOUD Act?
No. The GDPR regulates the processing of personal data but does not neutralise a foreign order. On the contrary, a disclosure under the CLOUD Act can create a conflict with the GDPR, exposing the organisation to CNIL sanctions. This is one of the arguments in the Schrems II debate.
Further reading
- Official text of the CLOUD Act, Public Law 115-141, Division V (govinfo.gov)
- Department of Justice, CLOUD Act resources page (justice.gov)
- European Data Protection Board, Initial legal assessment of the impact of the US CLOUD Act on the EU legal framework (2019)
- European Parliament study, Impact of US extraterritorial sanctions on European Union (2020)
- ANSSI, Doctrine cloud au centre (cloud first doctrine) and SecNumCloud framework (ssi.gouv.fr)