- The Cloud Act is a U.S. federal law enacted in March 2018. It requires any provider subject to U.S. jurisdiction to hand over data under its control to U.S. authorities, even if that data is stored outside the United States.
- The law does not target the nationality of the server but rather that of the company that controls it: a European subsidiary of an American corporation is still subject to the law.
- The European regulatory authority itself (the EDPB and EDPS, in a joint opinion) considers that a Cloud Act request generally cannot be lawfully executed under the GDPR without a prior international agreement.
- SecNumCloud is the only French certification that requires verified immunity against this type of legislation; the CNIL has explicitly pointed this out as a shortcoming in the EUCS European certification proposal.
What exactly is the Cloud Act?
The Cloud Act (Clarifying Lawful Overseas Use of Data Act) is a U.S. federal law enacted in March 2018. It does two distinct things. First, it enshrines a principle of jurisdiction in law: a company subject to U.S. law must produce data that it has «in its possession, custody, or control,» regardless of the country where that data is physically stored. Second, it establishes a framework for the United States to enter into bilateral agreements with other countries, allowing each country to directly request data from a provider subject to the other country’s jurisdiction.
Where does this law come from, and why does it target data stored outside the United States?
The Cloud Act legally resolves a dispute that arose in 2013: The U.S. Department of Justice had demanded that Microsoft hand over emails stored on a server in Ireland, citing a standard search warrant. Microsoft refused, arguing that a U.S. warrant could not apply to data hosted outside the United States. The Court of Appeals ruled in Microsoft’s favor in 2016; the case went all the way to the Supreme Court, and Congress settled the matter beforehand by passing the Cloud Act in March 2018: the location of the data becomes irrelevant; the only factor that matters is who controls the company hosting it.
Who is affected by the Cloud Act?
The law focuses on the legal nationality of the company that controls the data, not the location of the server that stores it, and most summaries oversimplify this point by referring to ’U.S. hosting providers« as if the nationality of the data centers were sufficient to settle the matter. The Cloud Act applies to any entity subject to U.S. jurisdiction, which includes a European subsidiary of a group whose parent company is U.S.-based, even if that subsidiary operates servers in France or Germany. A data center in Paris is not enough to fall outside the scope of the law if the operator running it remains a company organized under U.S. law or is legally subject to U.S. jurisdiction.
- What is not enough: A data center located in France or Europe.
- The following items are still affected: A European subsidiary of a group whose parent company is based in the United States.
- What matters most: The legal structure of the operator that operates the infrastructure.
The Cloud Act and the GDPR: A Real Conflict, Not a Hypothetical One
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have published a joint legal analysis on this topic: A request made under the Cloud Act generally cannot be legally enforced under the GDPR without a prior international agreement, such as a mutual legal assistance treaty. Article 48 of the GDPR specifically requires that a foreign judicial decision be based on such an agreement in order to be recognized in Europe. In practice, a provider caught between these two legal frameworks faces an impossible choice: comply with the U.S. order and risk violating the GDPR, or refuse and face penalties in the United States. The CNIL, for its part, is calling for European cloud certifications (such as the EUCS project) to include a criterion ensuring immunity from this type of law, a criterion that SecNumCloud already enforces.
How to Protect Yourself: The Role of the SecNumCloud Certification
The only structural solution is not a contractual clause or stronger encryption; it is the legal status of the operator itself. The Outscale Dassault Systèmes cloud is an entity governed by French law, with no U.S. parent company that would expose it to the Cloud Act. In its cloudgouv-eu-west-1 region, certified as SecNumCloud 3.2, this immunity is one of the requirements verified by ANSSI, not merely a marketing promise. The Ohmycad sovereign cloud offering is built on this foundation: the SecNumCloud region remains an option, activated when your regulations or your end customer require it, but the absence of any capital ties to a U.S. company is not contingent on any option.
Conclusion
The Cloud Act is not a theoretical threat bandied about by sovereign cloud vendors. It is a law that has been passed, enforced, and deemed incompatible with the GDPR by the European regulator itself in most concrete cases. Choosing a hosting provider means choosing who can be compelled to hand over your data, and under what legal authority.
The Outscale Dassault Systèmes cloud is a legal entity under French law, with no capital ties to a U.S. company, and features a cloudgouv-eu-west-1 region certified to SecNumCloud 3.2 for data requiring such certification. Ohmycad’s sovereign cloud offering builds its managed services on this legal foundation, not merely on a promise of data localization.
The right approach: Check who legally controls your hosting provider, not just where its servers are located.
Learn more about Ohmycad's sovereign cloud offering →
For more information: The Trusted Cloud Label · the SecNumCloud certification
Sources
- justice.gov, DOJ White Paper on the CLOUD Act
- EDPB / EDPS, Joint Legal Analysis on the Cloud Act
- CNIL, July 19, 2024, Risks of a European Certification Without an Immunity Criterion
FAQ
Frequently asked Questions
Does the Cloud Act apply only to U.S. companies?
No. It applies to any entity subject to U.S. jurisdiction, including a European subsidiary of a group whose parent company is based in the United States.
Can a web hosting provider with servers in France still be subject to the Cloud Act?
Yes, if the company that operates these servers is legally affiliated with a U.S. parent company. The physical location of the data is not sufficient to exempt it from the law; only the operator’s legal structure matters.
The Cloud Act and the GDPR: Which Takes Precedence in the Event of a Conflict?
Neither side has a clear victory, which is precisely the problem identified by the EDPB and the EDPS: without an international agreement between the United States and Europe, a Cloud Act request lacks a clear legal basis under the GDPR, which exposes the provider to a conflict of obligations.
Does the "Trusted Cloud" label provide protection against the Cloud Act?
That was its purpose: the certification meant that SecNumCloud also provided immunity from the Cloud Act. Since version 3.2 of the standard, this immunity has been verified by the SecNumCloud certification itself. Details can be found in our dedicated article.
Does SecNumCloud guarantee complete immunity from any foreign laws?
This certification verifies immunity from extraterritorial laws such as the Cloud Act, achieved through a European legal structure that is not dependent on any entity subject to those laws. Details of the criteria can be found in our article on SecNumCloud.
Need sovereign, managed, and encrypted hosting within your organization? An Ohmycad engineer will get back to you with a customized quote, not a generic price list: to be called back. The full list of offerings is on the page sovereign cloud.
