The Cloud Act Explained: Why European Businesses Should Care

If your company uses Google Workspace, Microsoft 365, AWS, or any other US-based cloud service, your data is subject to American law — regardless of where your servers are physically located. This isn't speculation. It's federal law, and it's called the CLOUD Act.

Signed in March 2018, the Clarifying Lawful Overseas Use of Data Act was designed to solve a jurisdictional problem for US law enforcement. But for European businesses, it created a much bigger one: a direct conflict with the GDPR that puts your company's compliance at risk.

What is the Cloud Act, exactly?

The CLOUD Act (Clarifying Lawful Overseas Use of Data) gives US law enforcement the legal authority to compel US-based companies to provide data stored anywhere in the world, as long as the company has "possession, custody, or control" over that data.

This means:

• Google can be forced to hand over your Gmail data, even if you specifically chose a European data center
• Microsoft can be ordered to provide your SharePoint files stored in Ireland or the Netherlands
• Amazon Web Services can be compelled to give access to databases hosted in Frankfurt

The key factor isn't where the data is stored. It's who controls the infrastructure. If the company is US-based or has significant operations in the US, the Cloud Act applies.

Cloud Act vs. GDPR: an irreconcilable conflict

The European General Data Protection Regulation (GDPR) states that personal data of EU residents cannot be transferred to third countries without adequate safeguards (Articles 44-49). The Cloud Act, on the other hand, demands exactly that transfer — and makes it illegal for companies to refuse.

This puts US-based cloud providers in an impossible position:

• Comply with the Cloud Act → violate the GDPR (risk: up to 4% of global turnover in fines)
• Comply with the GDPR → violate US law (risk: criminal contempt charges)

In practice, US companies almost always comply with US law enforcement requests. Between 2019 and 2024, Google received over 200,000 data requests from US authorities and complied with the majority of them.

The Schrems II connection

In July 2020, the Court of Justice of the European Union (CJEU) struck down the EU-US Privacy Shield in the landmark Schrems II decision (Case C-311/18). The court explicitly cited US surveillance laws — including the Cloud Act — as reasons why the US does not provide adequate data protection.

While the EU-US Data Privacy Framework was adopted in 2023 as a replacement, legal experts widely expect it to face the same fate. Max Schrems' organization noyb has already signaled its intent to challenge it.

Real-world consequences for European companies

1. Compliance risk

If your company processes personal data of EU residents using US cloud services, you are technically relying on a legal framework (SCCs + supplementary measures) that multiple EU Data Protection Authorities have questioned. Several DPAs have already ruled that using Google Analytics violates GDPR — and the same logic applies to Google Workspace, Microsoft 365, and AWS.

2. Trade secret exposure

The Cloud Act isn't limited to personal data. US authorities can request any data, including trade secrets, financial records, strategic documents, and proprietary code. A Cloud Act warrant doesn't require notification to the data owner — your company might never know its data was accessed.

3. Contractual liability

If you promise your clients that their data stays in Europe (common in B2B contracts), using a US cloud provider creates a breach of contract risk. This is increasingly relevant for companies in regulated industries: healthcare, finance, legal services, and government contracting.

4. Public sector exclusion

Multiple EU governments are now requiring "sovereign cloud" solutions for public sector contracts. France's SecNumCloud certification, Germany's Gaia-X initiative, and the broader European Cybersecurity Certification Scheme all effectively exclude standard US cloud offerings.

What European businesses should do

The good news: the European software ecosystem has matured significantly. There are now credible, feature-complete alternatives for virtually every US cloud service. Here's a practical action plan:

Step 1: Audit your US cloud dependencies

List every US-based service your company uses: email, file storage, CRM, project management, video conferencing, analytics. For each, identify what type of data flows through it (personal, financial, strategic).

Step 2: Prioritize by risk

Start with services that handle the most sensitive data. Email and file storage typically come first — they contain virtually everything.

Step 3: Evaluate European alternatives

Look for solutions that are:

• European-headquartered — not subject to the Cloud Act
• Hosted on European infrastructure — data physically stays in the EU
• GDPR-compliant by design — not as an afterthought
• Feature-competitive — migration shouldn't mean downgrading

Step 4: Plan the migration

Most European alternatives offer migration tools and documentation. Start with a pilot team, validate the workflow, then roll out company-wide. Budget 1-3 months for email/storage migrations, more for complex CRM or ERP transitions.

The bigger picture: digital sovereignty

The Cloud Act is a symptom of a larger issue: technological dependence. When European businesses rely entirely on US infrastructure, they expose themselves not only to legal risks but also to geopolitical ones. Tariffs, sanctions, policy changes, and trade disputes can all disrupt access to critical services.

Digital sovereignty isn't about rejecting technology from outside Europe. It's about having the choice — and ensuring that choice doesn't come with hidden legal strings attached.

The European software ecosystem is stronger than ever. Dozens of companies across the continent are building world-class alternatives that match or exceed US offerings in quality, while keeping your data under European law. The question is no longer whether suitable alternatives exist — it's whether you're willing to make the switch.