Contents (6 sections)
The “Cloud Act” has become the bogeyman of hosting discussions: often brandished, rarely read. The result is that you hear everything and its opposite, from “the Americans read your e-mails” to “it only concerns criminals”. Both are wrong. Here is what the law really allows, what it does not, and what it changes in practice for a French SME choosing where to host its data.
What exactly is the Cloud Act? #
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law passed in March 2018. It grew out of a concrete dispute: the Microsoft Ireland case, in which Microsoft refused to hand the FBI e-mails stored in its Dublin data centre, arguing that a US warrant stopped at the border. Congress settled the matter by rewriting the rule: a provider subject to US law must produce the data it holds, controls or keeps, wherever that data is stored.
This is the central point, and the only one you really need to remember: the Cloud Act is not about geography, it is about jurisdiction. The question is not “where is the server?” but “who controls the company that runs it, and under which law?”.
What does it allow in practice? #
- A US authority can serve an order (warrant or subpoena) on any company “subject to the jurisdiction of the United States”: an American parent company, but also the local subsidiary of a US group.
- The order covers the data the company holds or controls, including in a data centre in Paris, Frankfurt or Dublin.
- It can come with a duty of silence (gag order): the customer whose data is produced is not necessarily told.
- The law provides for bilateral agreements (executive agreements) and ways for the provider to challenge an order, within a set framework and at the provider’s discretion, not the customer’s.
What the Cloud Act is not: self-service access for US agencies to everything lying around. The procedure requires a judicial framework and targets specific investigations, and the major providers publish transparency reports. Reducing the debate to “they read everything” is wrong, but the opposite, “it will never concern me”, dodges the real question.
My servers are in Paris with an American provider: am I affected? #
Yes. That is precisely the case the law was written to cover. The French data centre of an American hyperscaler remains under the control of a company under US law: location answers a question of latency and marketing, not of jurisdiction. We went into this in our article on hosting in France: “hosted in Europe” and “under European law” are two different claims.
The location of a server is a geographical answer to a legal question. The Cloud Act does not care about geography.
And where does the GDPR fit in? #
The two texts contradict each other head-on. Article 48 of the GDPR provides that a decision by an authority of a third country requiring a transfer of personal data is only enforceable if it is based on an international agreement (mutual legal assistance, for example). A direct Cloud Act order that bypasses these channels therefore puts the provider in a dead end: break US law or break European law. The European Data Protection Board (EDPB) pointed out this conflict as early as 2019.
For you, the customer, the practical conclusion is simple: this conflict of laws is not yours as long as your hosting chain remains entirely under European law. It becomes yours as soon as an American link enters the chain.
Is an SME really at risk? #
Let us be honest: the probability that a US agency takes an interest in the customer file of an Alsatian SME is low. If the Cloud Act were only a question of probability, it would be a non-issue. But the risk lies elsewhere:
- Compliance: your DPO, your key account customers and public tenders ask the question in writing. “A hosting chain outside the scope of the Cloud Act” becomes a selection criterion.
- Cascading clauses: if you are a GDPR processor for your own customers, their sovereignty requirement contractually becomes yours.
- Dependency: the Cloud Act is a symptom. The underlying issue is that a third party outside your legal system can change the rules (terms, prices, access) without you having any real recourse.
- Sensitive sectors: health, legal, local authorities, defence: here the question is no longer theoretical at all.
How to get out of its reach, in practice #
Three levers, in order of effectiveness. One, choose providers under European law from end to end (hosting, but also e-mail, analytics, backup): the Cloud Act applies link by link, not on average. Two, for whatever must stay with an American player, encrypt with keys that only you hold: data produced in encrypted form without its key loses most of its value. Three, demand the DPA and the list of sub-processors from every provider: that is where the unsuspected American links hide.
This is the logic we apply to our own infrastructure: servers in France with operators under French law, an open-source technical stack, and sovereign hosting offered to our clients with a DPA and declared sub-processors. Not out of ideology, simply from reading the applicable law. It is in fact exactly the grid the French State made official in 2026 in its procurement doctrine: immunity from extraterritorial laws, ability to switch providers, technological control. A question about your own hosting chain? Let us talk.
