Security & governance
CLOUD Act
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a United States federal law passed in 2018. It confirms that US authorities can require providers of electronic communication and cloud services that are subject to US jurisdiction to disclose data in their possession, custody or control, regardless of whether the data is stored inside or outside the United States.
What does the CLOUD Act do?
The law has two parts. The first settles a question that had been litigated: a warrant or order served on a provider under the Stored Communications Act applies to data the provider controls anywhere in the world. The second creates a framework for executive agreements, under which approved foreign governments can send requests directly to US providers, and US authorities to providers in those countries, for serious crime investigations. Agreements with the United Kingdom and Australia have been concluded.
Which providers and data are covered?
The test is jurisdiction over the provider and control over the data.
| Question | Position under the Act |
|---|---|
| Does the data have to be in the US? | No. Location is not decisive |
| Which providers? | Those subject to US jurisdiction, including US companies and others with sufficient US presence |
| Which data? | Data within the provider's possession, custody or control |
| What legal process? | A warrant, court order or subpoena under existing US law |
| Can the provider object? | It may ask a court to modify or quash a request in limited circumstances |
How does it interact with European law?
The GDPR states that a foreign court order is not by itself a lawful ground for transferring personal data out of the EU. A provider caught between a US order and that rule faces conflicting obligations. This is one reason European regulators and public bodies ask who operates a service, in addition to where the data is stored, and why data localization alone is not treated as a complete answer. The wider issue is described under extraterritorial data access.
What limits its practical reach?
The Act compels providers to hand over what they are able to access. Data encrypted with keys the provider does not hold, as with hold your own key, can be produced only as ciphertext. And data on infrastructure that an organization owns and operates, using software from a vendor with no access to the stored data, is not in a provider's possession, custody or control at all. Requests for such data would have to go to the organization itself, through the legal channels of its own country. The CLOUD Act and storage looks at how this shapes storage decisions.
Frequently asked questions
Does the CLOUD Act let the US read any data stored with a US provider?
No. It requires legal process, such as a warrant issued by a court, in the context of a criminal investigation.
Does storing data in an EU region of a US cloud avoid the CLOUD Act?
Not by location alone. The Act applies to data the provider controls wherever it is stored.
Does the CLOUD Act apply to on-premises software?
It applies to providers that control data. A software vendor that cannot access customer data has nothing in its control to disclose.
Related terms
- Extraterritorial data access: the general issue the Act illustrates.
- Data localization: location rules, which the Act does not turn on.
- Hold your own key (HYOK): a technical limit on what can be disclosed.
- GDPR: the EU regulation the Act can conflict with.
- Bring your own key (BYOK): customer keys held inside the provider's service.