The CLOUD Act explained
What the US law covers, why data storage in Europe does not protect you and what businesses can do.
The CLOUD Act is a US law that gives US authorities access to data held by US providers, even when that data is stored in Europe. It affects services such as Microsoft 365, Google Workspace, AWS, Azure, Salesforce and many more.
In June 2025, Microsoft France told the French Senate it could not guarantee that data would never be handed to US authorities (report). This has significantly intensified the debate about digital sovereignty in Europe.
There are European alternatives for most services. See the overview: European alternatives to US software.
Key points
In force since 2018
The Clarifying Lawful Overseas Use of Data Act is a US law from March 2018. It governs when US authorities can demand data from providers.
Control, not location
What matters is whether a US company controls the data, not where it is stored. This also applies to data centers in Germany and to European subsidiaries.
Conflict with the GDPR
European data protection authorities consider a transfer based solely on the CLOUD Act generally incompatible with Art. 48 GDPR (e-recht24). Providers are caught between two legal systems.
When the CLOUD Act applies
Simplified overview. In individual cases, the provider’s ownership and control are decisive.
| Provider | Storage location | CLOUD Act applies |
|---|---|---|
| US provider | USA | yes |
| US provider | Data center in Germany | yes |
| European subsidiary of a US corporation | Data center in Germany | yes, according to most assessments |
| European provider without a US parent | Europe | generally no |
| Your own servers | your own data center | no |
What businesses can do
-
Take stock
Which services from US providers are in use, and what data is stored there?
-
Assess the risks
Where are trade secrets, personal data or particularly sensitive data?
-
Review alternatives
There are European solutions for most services. Not everything has to switch at once.
-
Switch step by step
Start with the most critical data, and the rest follows according to plan.
Frequently asked questions
What is the CLOUD Act?
A US law from 2018 that requires US providers to hand over data when ordered by US authorities, regardless of where the data is stored.
Does the CLOUD Act apply to data centers in Germany?
Yes, if a US company controls the data. In June 2025, Microsoft France told the French Senate it could not rule out a transfer to US authorities.
Do EU data centers or sovereign cloud offerings from US providers protect us?
They improve data residency and operation within the EU. Whether they protect against the CLOUD Act is disputed as long as the provider belongs to a US corporation.
What about the EU-US Data Privacy Framework?
The framework governs transfers of personal data to the US. It does not remove US authorities’ access to data held by US providers under the CLOUD Act.
Do I have to switch off all US services now?
No. A sensible approach is to take stock and then switch step by step, starting with the most sensitive data.
This page provides a general overview and does not replace legal advice.
European alternatives
Review your dependence on US software
We look at which US services you use and show where European alternatives exist.