The CLOUD Act allows U.S. authorities to access data stored in the EU, putting it in direct conflict with GDPR. Learn how this impacts data sovereignty and what EU businesses can do to stay compliant
For organizations operating in or with the European Union, understanding how data privacy laws intersect across borders is foundational. And yet, the U.S. CLOUD Act continues to create confusion about what digital sovereignty actually means in practice.
This blog explains the key implications of the CLOUD Act, why it conflicts with European data protection principles like the GDPR, and what it means for businesses trying to protect their sensitive communications.
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a U.S. federal law passed in 2018. It allows U.S. law enforcement to compel American companies to provide access to data stored abroad, even if that data belongs to non-U.S. persons and resides in data centers located in the European Union.
That includes:
The CLOUD Act overrides local data protection laws whenever criminal investigations involve U.S. interests. Its scope is extraterritorial, meaning it applies regardless of where the data is physically stored, as long as the service provider is based in the United States. It grants U.S. authorities the power to access personal, corporate or even classified data with a warrant, without prior notice to affected users or European regulators.
This is where the conflict begins.
Under the GDPR, data transfers outside the EU require a legal basis. Article 48 of the GDPR states that court orders from third countries (like the U.S.) are only valid if they are based on an international agreement such as a Mutual Legal Assistance Treaty (MLAT). The CLOUD Act, however, bypasses MLATs altogether.
This puts companies in a legal dilemma:
The European Data Protection Board has made it clear: Service providers subject to EU law cannot legally base data transfers to the U.S. solely on CLOUD Act requests.
Unlike earlier mechanisms such as the MLAT, the CLOUD Act does not require cooperation between governments. It gives U.S. authorities unilateral access to data, without a requirement for judicial review in the EU, nor sufficient legal recourse for EU data subjects.
Although there is a provision allowing U.S. service providers to “quash or modify” a request if it conflicts with a foreign law, this option is rare, complex, and discretionary. In most cases, it will not prevent the transfer of European data.
On the surface, a U.S. company might promise that your data “never leaves the EU.” But under the CLOUD Act, location is irrelevant. Jurisdiction follows ownership.
So even if data is hosted in Frankfurt or Paris, if it’s managed by a U.S.-based provider, it can legally be accessed by U.S. authorities, without involving the user or any European public authority. This directly undermines:
When U.S. law enforcement issues such requests, European businesses and service providers should not comply directly. Instead, they should refer these cases to the Mutual Legal Assistance Treaty (MLAT), which includes stronger procedural safeguards and legal certainty under EU law. Unless a CLOUD Act warrant is made enforceable through the MLAT and recognized under GDPR, there’s no lawful basis for handing over EU personal data.
For companies handling sensitive information, whether trade secrets or personal client data, this legal conflict creates real risk. As a result, more organizations are shifting focus from where the data is stored to who controls the infrastructure. If the provider is under U.S. jurisdiction, full GDPR compliance cannot be guaranteed. That’s why choosing an EU-based provider isn’t just a preference. It’s a necessity for data protection and sovereignty.
The GDPR was designed to protect individuals’ rights to privacy and data protection within the EU. It enforces strict rules on how data can be processed, stored and transferred, especially across borders.
The CLOUD Act bypasses that by:
This puts organizations in a bind: comply with GDPR and risk violating the CLOUD Act, or comply with U.S. subpoenas and risk GDPR penalties.
Many global providers now offer EU-based data centers and services marketed as “sovereign.” But sovereignty isn’t just about where data is stored, it’s about who controls it.
If a cloud provider is headquartered in the U.S., the CLOUD Act still applies. That includes:
These offerings provide the illusion of control, while remaining subject to U.S. legal demands.
If your organization needs to ensure true digital sovereignty and compliance, consider:
For sectors like healthcare, defense, government and finance, these steps are essential for protecting sensitive communications and maintaining legal compliance.
The CLOUD Act introduces a real and unresolved conflict for EU organizations using U.S.-based service providers. It bypasses European legal frameworks and challenges the very idea of data sovereignty.
If your provider is subject to U.S. jurisdiction, your data may not be safe, even if stored within the EU. Sovereignty is not a marketing claim, it’s a legal reality.
Real control starts with choosing infrastructure aligned with your legal environment. That means European-built, open-source, and jurisdictionally secure platforms like Wire.
NIS2 is reshaping cybersecurity across Europe. With stricter rules and higher penalties, organizations are acting fast to meet compliance and protect...
Be ready when cyber crises strike. Learn what to do in the first 72 hours after a data breach. Our checklist helps you act fast, stay compliant with...
Despite prioritizing encryption and EU data hosting, European organizations still rely on US platforms like Microsoft Teams. Explore the four key...