The rules, in plain words
US CLOUD Act
Clarifying Lawful Overseas Use of Data Act · US federal law, enacted 2018 · US
US authorities can compel a US-based provider to hand over data it controls, even when that data is stored on servers in Europe.
Who it applies to. US-headquartered technology providers and their subsidiaries. Practically: anyone whose data sits with a US-owned cloud, regardless of which region it is stored in.
In plain words
This is US law, not EU law, and it is the single most common reason an EU buyer probes a residency claim. A US provider can be served with lawful process for data it controls - and control is not the same thing as physical location. Storing data in Frankfurt does not by itself place it beyond that reach.
It is worth being accurate rather than alarmist. The CLOUD Act sets out a legal process with grounds and limits; it is not a licence for open access, and providers publish transparency reports and contest requests. But the residual exposure is real, and a sophisticated buyer will ask about it.
This is the tension that sovereign cloud offerings exist to address, and the reason a residency answer that only covers storage location tends to fall apart under the second question. The useful answers are architectural: who holds the keys, who can administer the environment, from where, and what is technically possible rather than merely contractually promised.
Timing
When it applies.
- 2018
- Enacted in the US, clarifying that stored-data warrants can reach data held abroad by US providers.
What it means for your architecture
The part that is decided at design time.
- Key management is the lever that matters most. Who can decrypt, and can the provider do it without you?
- Administrative access matters as much as storage location - support paths and control planes are where the real exposure usually sits.
- The honest answer for most estates is not 'no exposure' but 'here is exactly what the exposure is, and here is what reduces it'. Buyers respect that far more than a blanket assurance.
- It is also why the delivery team matters, not just the region: where EU-resident delivery is agreed, the people with access are inside EU jurisdiction too.
Read the real thing
- CLOUD Act, full statutory text (US Department of Justice, PDF)
- US Department of Justice CLOUD Act resources
This is an engineering explainer, not legal advice. How the rules apply to your organisation is a question for your counsel and your compliance function. What your architecture can evidence against them is the question Northkeep answers.
Also worth knowing
The other rules in play.
-
DORA
Financial firms must prove they can keep running when their technology fails - including when the failure is at a supplier like AWS.
-
NIS2
Medium and large organisations across 18 sectors must manage cybersecurity risk properly, report significant incidents fast, and hold their management personally accountable for it.
-
EU AI Act
AI systems are sorted by how much harm they could do, and the riskier ones carry real obligations - documentation, human oversight, logging and data governance.