The “Cloud au Centre” doctrine, published by DINUM in 2021 and updated in 2023, governs the use of cloud by the French administration. Prime Minister’s circular 6282/SG requires sensitive data to be hosted on an internal cloud or on an offer qualified SecNumCloud by ANSSI. This framework is complemented by the GDPR, the NIS2 directive and, for health, the HDS certification. The regulatory references cited on this page can be consulted on legifrance.gouv.fr and cyber.gouv.fr.
Who this doctrine is for
Central government
- Legal sovereignty over sovereign-function data and sovereignty databases.
- Extraterritorial immunity required for data classified DR (Diffusion Restreinte) or above.
- SecNumCloud qualification made mandatory by circular 6282/SG for sensitive information systems.
Local authorities
- Heterogeneous information systems: gradual control of cloud technical debt.
- Citizen data (civil registry, social services, urban planning) protected by GDPR article 9 for sensitive categories.
- Pooling possible through purchasing bodies (UGAP, GIP, joint syndicates).
Public bodies
- Universities, hospitals, agencies: business information systems often multi-provider.
- Research, health and education data subject to specific regimes.
- Contractual reversibility required when contracts are renewed.
Operators of vital importance
- OIV or OSE status governed by the LPM (Military Programming Law) and the NIS2 directive.
- National hosting mandatory for essential functions, under ANSSI supervision.
- Documented continuity and recovery plans, regular audits.
The applicable references
Cloud au Centre doctrine
Published by DINUM in May 2021, updated in May 2023. Requires priority use of an internal State cloud or a commercial cloud qualified SecNumCloud for sensitive data. Source: circular 6282/SG, available via legifrance.gouv.fr.
SecNumCloud (ANSSI)
Security approval issued by ANSSI under the SecNumCloud v3.2 framework. Attests compliance with requirements for sovereignty, protection against foreign interference and operational security. Public list of qualified providers on cyber.gouv.fr.
GDPR (CNIL)
Regulation (EU) 2016/679. Article 9 governs sensitive data (health, political opinions, biometric identifiers). Since the Schrems II judgment (CJEU, 2020), the CNIL has recommended EU hosting and documentation of transfers outside the EEA.
NIS2 directive
Directive (EU) 2022/2555, transposition into French law under way. Extends the scope of essential and important entities, strengthens requirements for risk management and incident notification. Applies to government departments and to some public operators.
Three recurring situations
Hosting regional health data
Requirements
- HDS (Health Data Hosting) certification mandatory.
- Data, metadata and logs located in France or in the EU.
- Written commitment on extraterritorial immunity for sensitive categories.
Candidate providers
SecNumCloud-qualified providers that also hold HDS certification for the assessed scope.
Citizen digital identity platform
Requirements
- eIDAS compliance for identity verification and qualified signatures.
- Master keys encrypted in certified European HSMs.
- Annual security audit by an accredited third party.
Candidate providers
SecNumCloud-qualified providers with a sovereign IAM offer and eIDAS-certified EU HSMs.
Long-term storage of public archives
Requirements
- Regulatory retention (Heritage Code, processing period).
- Data reversibility in open formats (PDF/A, standardised XML).
- EU location commitment across the entire life cycle.
Candidate providers
EU providers offering WORM object storage, sealing and contractual reversibility.