In short
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law of March 2018 that obliges providers under US jurisdiction to hand over stored data on the order of US authorities, regardless of where in the world this data is physically located.
For European companies, the law is the reason why the question of location answers less in the choice of cloud than many brochures promise. A data centre in Frankfurt or Paris changes nothing about the reach of the CLOUD Act as long as the operator belongs to a US parent company. Anyone who wants to understand its scope has to take a brief look at the background, because the law is the direct answer to a lost legal dispute.
Origins: the Microsoft Ireland case
In 2013, in a drug investigation, the US Federal Bureau of Investigation (FBI) used a search warrant to demand emails that Microsoft stored in its Dublin data centre. The basis was the Stored Communications Act of 1986, a law from the time before cloud computing. Microsoft refused to hand them over, arguing that a US warrant did not extend to Irish servers, and won on appeal in 2016. The dispute went all the way to the Supreme Court as Microsoft Corp. v. United States.
The case exposed a structural problem: the regular route for cross-border evidence gathering, the mutual legal assistance treaty (MLAT), takes months in practice and was never built for the speed of digital investigations. Two attempts to solve the problem by law initially failed: the LEADS Act of 2015 and the International Communications Privacy Act of 2017 never got beyond the draft stage.
There was never a judgment either. While the proceedings were ongoing, the US Congress passed the CLOUD Act and answered the open legal question by statute: on 23 March 2018, it came into force as part of a spending bill (Consolidated Appropriations Act, Division V). The Department of Justice immediately obtained a new warrant on the new basis, and the Supreme Court declared the case moot in April 2018. The US Department of Justice has published a white paper with its own detailed presentation of the law; the Wikipedia article on the CLOUD Act provides a neutral overview.
Core mechanism: "possession, custody, or control"
The heart of the law is an addition to the Stored Communications Act (18 U.S.C. § 2713). Providers must hand over data that is in their "possession, custody, or control", in the words of the statute. The storage location is thus expressly irrelevant. Covered are providers of electronic communication and cloud services that operate in the USA or have a legal presence there. This by no means limits the effect to US corporations: a European provider with a US branch can also fall within the scope. And because courts can oblige the parent company to hand over data held by a subsidiary abroad, a European subsidiary with its own data centre does not protect against this reach.
The procedure runs entirely under US law: a court order or subpoena is sufficient, and a request for legal assistance to the state in which the data is located is no longer necessary. The provider can challenge the order if it brings it into conflict with the law of a partner country; however, this option is narrowly defined and hardly applies in practice in relation to the EU. The law contains no obligation to inform the person concerned or a European supervisory authority.
Executive agreements: the second pillar
In addition to the disclosure requirement, the CLOUD Act created an instrument called an executive agreement: bilateral agreements with which partner states gain direct access to data held by each other's providers, bypassing the slow route of legal assistance. The USA concluded the first agreement with the United Kingdom, and another followed with Australia. Talks between the USA and the EU on such an agreement have been running intermittently since 2019 without an agreement being reached. Until then, access to EU data via the CLOUD Act remains a one-sided process in which European bodies are not involved.
CLOUD Act and GDPR: the tension
From a European perspective, the CLOUD Act collides with the system of the GDPR. According to Art. 48 GDPR, decisions of authorities and courts from third countries that require a transfer of data may only be recognised if they are based on an international agreement such as a mutual legal assistance treaty. It is precisely this route that the CLOUD Act bypasses by design. In their joint response of July 2019, the European Data Protection Board and the European Data Protection Supervisor therefore already concluded that disclosure based solely on a CLOUD Act order generally has no legal basis under the GDPR; as a rule, only the route via a mutual legal assistance treaty would be viable.
This creates a dilemma for providers: if they comply with the US order, they risk a GDPR violation and a fine. If they refuse to hand over the data, they face sanctions in the USA. This conflict has not been resolved to this day; it is endured case by case. For the companies affected, this is the most unpleasant feature of the situation: whether and how often their data is the subject of such orders, they may never find out.
Classification: support, criticism and international impact
What is remarkable about the history of the law is who wanted it. Alongside the US Department of Justice, it was supported by none other than the big technology companies, including Microsoft, Apple and Amazon Web Services. From their point of view, the CLOUD Act ended an untenable state of limbo: after the Ireland case, it was unclear which law they had to follow for cross-border requests. The law gave them a clear, if one-sided, framework.
The criticism came from civil rights organisations such as the Electronic Frontier Foundation, the ACLU, Amnesty International and Human Rights Watch. Their objections: the law weakened the protection of the Fourth Amendment against unreasonable searches, the executive agreements bypassed judicial review, and those affected would learn nothing of disclosure requests. In the international debate, the CLOUD Act is also regularly placed alongside China's National Intelligence Law, which obliges Chinese companies to cooperate with the authorities; the mechanics of extraterritorial access obligations are the same in both cases, even though the rule of law and control mechanisms differ considerably. The most visible consequence worldwide: after the law was passed, numerous states introduced localisation and sovereignty requirements for data. The CLOUD Act has thus itself accelerated the fragmentation of the global data space that it ignored.
Practical consequence: data residency is not sovereignty
The most important consequence for architecture planning is this: an EU data centre of a US provider offers data residency, but not digital sovereignty. Legal access follows the ownership structure, not geography. How robust this assessment is was shown by a hearing in the French Senate in June 2025: Anton Carniaux, director of public and legal affairs at Microsoft France, was asked under oath whether he could guarantee that the data of French citizens would never be transferred to the US government without the consent of the French authorities. His answer: he could not guarantee it. What was remarkable about this was not the legal situation, which was known to experts, but that a company representative confirmed it so unambiguously for the first time.
The hyperscalers' "sovereign" cloud offerings, from EU data boundaries to formally independent European structures, also change little about the basic mechanism: they move data, staff and operations to Europe, but control over the company remains with the US corporation. Such constructions reduce practical risks and may be entirely sufficient for many workloads. One should just state precisely what they achieve: risk reduction, not immunity.
Options for companies
The CLOUD Act is no reason to panic, but it is a reason to classify data. A tiered approach has proven effective:
- Classify data: which holdings are so sensitive (trade secrets, research data, special categories of personal data) that possible third-country access would be unacceptable? Only this class needs structural consequences.
- Run sensitive workloads in Europe: on providers without a US parent (such as Hetzner, IONOS, STACKIT) or via self-hosting on your own infrastructure, for example with tools such as n8n for process automation.
- Check key sovereignty: encryption only protects if the provider cannot use the keys itself. Client-side or end-to-end encryption is effective but costs functionality; "bring your own key" models, in which the provider decrypts during operation, are largely ineffective against official disclosure obligations.
- Tighten contracts: the data processing agreement should address disclosure requests: the provider's obligation to challenge them, notification as far as legally permissible, transparency reports.
- Keep the ability to exit: anyone who can switch negotiates differently and reacts faster to changes in the law. The lever against vendor lock-in is therefore also a lever against the CLOUD Act risk.
Frequently asked questions about the CLOUD Act
Does the CLOUD Act only affect private individuals or also company data?
Both. The law speaks of data of a "customer or subscriber" without distinguishing between private and business customers. In a US investigation, emails, documents or database holdings of a European company can therefore also be demanded, provided they are held by a provider under US jurisdiction. For trade secrets this is the really delicate point, because unlike personal data, there is no accompanying protective regime such as the GDPR here.
Does the CLOUD Act also apply to European subsidiaries of US corporations?
Yes. What matters is whether data is in the possession, custody or control of a provider subject to US jurisdiction. US courts can oblige the parent company to produce data stored by its European subsidiary. Conversely, a European company with its own US branch can also fall within the scope.
Does an EU data centre protect against the CLOUD Act?
No. Under the law, the storage location is expressly irrelevant. An EU data centre improves latency, data residency and often also GDPR documentation, but changes nothing about the US provider's obligation to disclose. Protection is only offered by a structure in which no party with access to the plain-text data is subject to US jurisdiction.
Is the CLOUD Act the same as FISA 702?
No. The CLOUD Act is an instrument of law enforcement: it regulates disclosure obligations in specific investigations with a court order. Section 702 of FISA concerns the intelligence surveillance of non-US persons outside the USA. Together, the two regimes make up the access risk that is negotiated in European debates about US clouds.
Does the CLOUD Act make the use of US cloud services illegal?
No. Data transfers to the USA are currently based on the EU-US Data Privacy Framework, whose adequacy decision the General Court of the EU confirmed in September 2025; an appeal is pending before the Court of Justice. But permissibility and risk are two different questions: for non-critical workloads, the US cloud remains a legitimate choice; for highly sensitive data, an architecture that structurally rules out third-country access is advisable, rather than merely regretting it in the contract.