Se rendre au contenu

Cloud Act: The Risks to Your Data and How to Respond

Cloud Act: who is affected, what hosting in France really changes, what the GDPR says, and how to assess your data's exposure.

Cloud Act: The Risks to Your Data and How to Respond

IT managers reviewing a company's data hosting in a server room

The Cloud Act is a 2018 US law that allows US law enforcement to access data stored by American cloud providers, whether the servers are in the United States or abroad. Hosting your data in France is therefore not enough if the provider is subject to US law. To assess your exposure, look at who operates the service and which law applies to them, not just where the servers are.

Key takeaways:

  • Passed by the US Congress in 2018, the Cloud Act covers data held by American providers, including on servers located outside the United States.
  • Storing data in France does not settle the question on its own: you also need to check which law applies to the provider and its parent company.
  • Article 48 of the GDPR makes the recognition or enforcement of a third-country decision conditional on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer.
  • The Cloud Act and the Data Privacy Framework are two separate issues: the first concerns judicial access to data, the second governs transfers of personal data to the United States.
  • Start by mapping your data and your vendors, then prioritize the most sensitive data entrusted to providers subject to US law.
Yundera
Stay in control of your data
Yundera offers a managed private server in France, with your apps and data under your control and no technical skills required.

Table of Contents

What is the Cloud Act, in simple terms?

The Cloud Act, short for Clarifying Lawful Overseas Use of Data Act, is a US law passed by Congress in 2018 that authorizes US law enforcement to access data stored by American cloud providers, whether the servers are in the United States or abroad. The key criterion is therefore not where the data is stored, but which provider holds it.

Two misconceptions come up often:

  • It is not an open right of access: the law does not give US authorities permanent access to view data. Access goes through a request sent to the provider within a legal framework, and a well-founded court order is one example.
  • It is not limited to American data: the law can reach personal data held by an American provider, including on servers located outside the United States. A French SMB can therefore be exposed through its vendors.

Many companies still know little about this law. According to a Ionos study published in 2019 of 500 French IT decision-makers, 33% of the companies surveyed said they did not understand what it involved. The figure is dated, but it points to a useful reality: you can choose a cloud service without ever checking which law its provider is subject to.

Does the Cloud Act affect my company?

Yes, your company can be affected as soon as it entrusts data to an American cloud provider, even if it has no operations in the United States itself. The law targets data stored by these providers: the request goes to the vendor first, and the customer is exposed through them.

To gauge this exposure, review your main services:

  • Email: who operates your mailboxes and keeps their archives?
  • Storage: where are your shared files, and which provider holds them?
  • Office suite: do your documents, calendars and contacts depend on an American vendor?
  • CRM: which company hosts your customer and sales data?
  • Backups: are your copies entrusted to the same provider or to another American company?
  • Subcontractors: do your French vendors themselves rely on an American cloud?

For each service, note the company that signs the contract, its parent company and any subcontractors named in its contractual documents.

The case of a French company with a subsidiary or operations in the United States is more delicate. The sources consulted for this article do not support a general rule: the answer depends on how the group is organized and which entity actually holds the data. In this situation, have your case reviewed by a specialist lawyer.

Does hosting your data in France protect you from the Cloud Act?

No, hosting your data in France does not by itself protect you from the Cloud Act if the provider remains subject to US law. A server in Paris or Marseille settles the question of location, not the question of which law governs the company holding the data.

The testimony of Anton Carniaux, Director of Public and Legal Affairs at Microsoft France, illustrates this well. On June 10, 2025, before the French Senate's committee of inquiry on public procurement, he was asked about the transmission of French government data to the US government. According to ActuIA, he acknowledged that in the event of a well-founded US court order, Microsoft is legally required to hand over this data.

The Senate minutes also provide some context:

  • Contractual commitment: “we make contractual commitments to our customers, including those in the public sector.”
  • Scope of responses: “we respond in extremely specific and limited cases.”
  • Stated track record: “for the past three years, no request of this kind has affected a European company.”

These statements suggest that the risk appears limited in practice, according to the provider itself, but they do not remove it legally. When assessing a service, look at the location of the servers, but also at the identity of the provider and its parent company.

Is the Cloud Act compatible with the GDPR?

Compatibility between the Cloud Act and the GDPR is not straightforward: the two laws can come into tension, but that does not amount to a general, definitively settled incompatibility. The friction point lies in Article 48 of the GDPR.

It provides that a decision by a court or administrative authority of a third country requiring the transfer or disclosure of personal data can only be recognized or made enforceable if it is based on an international agreement, such as a mutual legal assistance treaty. The article adds an important caveat: this rule applies “without prejudice to other grounds for transfer” set out in the same chapter.

In practice, a provider subject to both legal systems can find itself in a difficult position:

  • On the US side: it may receive a request that US law requires it to answer.
  • On the European side: it must check on what basis a disclosure of personal data can be permitted under the GDPR.

Article 48 is therefore not an absolute ban on all disclosure, but it is not enough to validate a foreign request either. For customers, the consequence is practical: ask your provider how it handles these requests and what commitments it makes by contract. For a sensitive or disputed case, consult a specialist lawyer.

What is the difference between the Cloud Act and the Data Privacy Framework?

The Cloud Act concerns judicial access to data held by an American provider, while the Data Privacy Framework (DPF) governs transfers of personal data from the European Union to the United States. The two topics overlap in cloud contracts, but they do not answer the same question:

  • Cloud Act: can US authorities obtain data from this provider, including data stored outside the United States?
  • DPF: can a company transfer personal data to a US recipient on the basis of this European framework?

A DPF certification therefore does not by itself remove exposure to the Cloud Act. It can be useful when analyzing a transfer, but it does not change the law the provider remains subject to.

The DPF is also still being challenged. According to the law firm WilmerHale, the EU General Court upheld the validity of the 2023 adequacy decision in September 2025, and French MP Philippe Latombe then filed an appeal on October 31, 2025. The firm raises the possibility of a reversal on appeal. This analysis dates from December 2025, so check the status of the proceedings before relying on the DPF.

Pro tip: in your records of processing activities, note the transfer basis and the law applicable to the provider separately. This keeps you from treating these two questions as one.

How can you assess your data's exposure in 4 steps?

To assess your data's exposure, link each service to its provider, the law that applies to it and the sensitivity of the information involved. Four steps are enough to get a usable first overview:

Person checking a list of their company's data and vendors on a computer

  1. List your data and vendors: take stock of your services, including SaaS tools, backups and subcontractors.
  2. Identify the applicable law: check the provider's headquarters, its parent company and any operations in the United States.
  3. Rank by sensitivity: start with health data, trade secrets and HR data.
  4. Choose the right measure: keep the service, strengthen the contract, encrypt with your own keys or switch vendors.

For an SMB, a simple spreadsheet is enough. Plan for six columns: service, data, provider, applicable law, sensitivity and decision. Here is a fictional sample row:

  • Service: shared storage
  • Data: customer contracts and HR files
  • Provider: French subsidiary of an American group
  • Applicable law: to be confirmed with the provider and a lawyer
  • Sensitivity: high
  • Decision: move HR files first

When talking to the provider, use Article 48 of the GDPR as a checkpoint: ask how it handles a third-country decision requiring the transfer or disclosure of personal data, and keep its written response.

Does SecNumCloud really protect you from the Cloud Act?

SecNumCloud greatly reduces the risk associated with the Cloud Act, but it does not guarantee complete, permanent protection. Since version 3.2, released in 2022, this qualification issued by ANSSI has included requirements for immunity from extraterritorial laws. Le Monde Informatique cites three of them:

  • European provider: the registered office and capital must be European.
  • Data access: non-European subcontractors or suppliers must not have access to the data.
  • Operations: the provider must remain autonomous in operating the solution.

According to the same article, this European control offers “a good guarantee that the provider will not comply with an order from a non-European authority.” However, this guarantee has its limits. The article, published on January 8, 2026, describes the protection as “partial, or at any rate limited in time.” It also quotes Vincent Strubel of ANSSI: “A SecNumCloud qualification does not mean that the cloud provider can operate in complete self-sufficiency over the long term, without relying on non-European suppliers.”

SecNumCloud therefore remains a relevant benchmark for highly sensitive data, provided you check the exact scope of the qualified offering. For a small organization, it will rarely be the first criterion: your data inventory, your choice of provider and your options for encryption or exit often lead to more immediate decisions.

What can you do without migrating everything?

Without migrating everything, you can reduce your exposure by matching your measures to the sensitivity of each use. Start from your inventory and work through these levels:

  1. Keep low-sensitivity uses: public sales materials or documentation containing no personal data do not necessarily justify an immediate change.
  2. Question the provider: ask for its contractual commitments and transparency reports. Microsoft France, for example, told the Senate that it publishes such reports twice a year. Read their scope carefully, as they may not describe your situation.
  3. Encrypt sensitive data: where possible, keep the keys on your side, outside the service that stores the files. Also check which features you lose, such as search or online editing.
  4. Move critical data: start with the data whose exposure would be most serious, moving it to a vendor not subject to US law, then check that vendor's parent company and subcontractors.

Encryption reduces risk, but it does not replace legal analysis: it says nothing about the law applicable to the provider or your obligations under the GDPR. Likewise, a contractual commitment spells out what the vendor promises, but it does not remove any legal obligation that may apply.

Pro tip: test restoration and decryption before migrating, then record who holds the keys and who can recover them if an administrator leaves.

Yundera: a private server hosted in France to take back control

To take back control of some of your data, Yundera offers a concrete option: a managed private server (Personal Cloud Server), hosted in France and dedicated to a single customer. It can hold the data that your inventory led you to move out of mainstream services. This solution does not replace an analysis of your legal situation, especially if your data has a link to a country outside the EU, a topic covered in our article on hosting outside the EU and the GDPR.

Yundera

The server comes with ready-to-use open source applications for file storage, photos, website hosting, office work and more. They install in one click from an app store. Each application is available on your own domain over HTTPS, with no static IP, port forwarding or manual certificate setup. Your data stays on your server: Yundera does not collect it or resell it. No technical skills are required, because Yundera manages the server.

You can therefore start small, for example with the files marked as priorities in your spreadsheet, then decide what comes next based on your needs. To see plans and pricing, visit the Yundera private servers page.

Private server vs American cloud: comparison diagram

Cloud Act: the most common mistakes companies make

The most common mistake is believing that a server in France is enough, when the law applicable to the provider matters too. Other misconceptions come up regularly: treating the Cloud Act and the DPF as the same thing, stopping at the name of the French subsidiary without looking at the parent company, or leaving backups and subcontractors out of the analysis. A contract clause is not an absolute guarantee either: it formalizes a commitment, but may not rule out a legal obligation. Finally, migrating everything in a rush creates new risks, such as data loss or misconfigured access, and ties up resources on uses that are sometimes low in sensitivity.

The safest approach remains simple: build an inventory of your services and providers, then deal with the most sensitive data first. You can then decide, service by service, whether to keep, strengthen or move, with a written justification for each choice.

— Yundera

Sources

Frequently Asked Questions

What is the Cloud Act?

The Cloud Act, or Clarifying Lawful Overseas Use of Data Act, is a US law passed in 2018. It authorizes US law enforcement to access data stored by American cloud providers, whether the servers are in the United States or abroad.

Does the Cloud Act apply to data hosted in France?

Yes, it can apply if the data is held by a provider subject to US law. Hosting in France settles the question of location, but not the question of which law governs the provider.

Is the Cloud Act compatible with the GDPR?

The two laws can come into tension, but that does not amount to a general, definitively settled incompatibility. Article 48 of the GDPR makes the recognition or enforcement of a third-country decision conditional on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer. A provider subject to both legal systems can therefore find itself in a difficult position.

Can a French company be affected by the Cloud Act?

Yes, particularly when it entrusts its data to an American cloud provider, even without operations in the United States. If the company itself has a US subsidiary or operations, the answer depends on how the group is organized and which entity holds the data, which calls for a case-by-case legal analysis.

Does encryption protect against Cloud Act requests?

Encryption reduces the risk, especially when the customer keeps the keys outside the service that stores the data. However, it does not replace legal analysis, because it changes neither the law applicable to the provider nor your obligations under the GDPR.

Recommended Reading

Se connecter pour laisser un commentaire.