Security & governance
Extraterritorial data access
Extraterritorial data access is the ability of a government to obtain data stored outside its own territory, by placing a legal obligation on a company that falls under its jurisdiction. The data may sit in a data center in another country. What matters legally is who controls it, and which state can compel that party.
How does a law reach data in another country?
Most such laws attach to the provider, not to the location. If a company is headquartered in a country, or does enough business there to be subject to its courts, it can be ordered to produce data in its possession, custody or control, wherever that data is physically held. The US CLOUD Act states this explicitly for providers of communication and cloud services. National security and intelligence laws in several countries have comparable reach.
Why does data location alone not prevent it?
Keeping data in a particular country, as in data localization, determines which local law applies to the data center. It does not change who operates the service. A region run by a foreign-headquartered provider keeps the data in the country and leaves the provider answerable to its home jurisdiction. Location and control are separate questions, and sovereignty assessments increasingly ask both.
| Factor | What it determines |
|---|---|
| Where the data is stored | Which local law protects it, latency, residency rules |
| Who operates the storage | Which governments can compel the operator |
| Who holds the encryption keys | Whether compelled data is readable |
| Who can administer the system | Whether access is technically possible at all |
Which controls reduce the exposure?
Three kinds of measure are used. Legal measures, such as contract terms requiring the provider to challenge requests and notify the customer, offer limited protection because the provider must still comply with a valid order. Technical measures are stronger: if the customer holds the encryption keys outside the provider's reach, as with hold your own key, the provider can hand over only ciphertext. Structural measures go furthest: running the storage on infrastructure the organization operates, with software whose vendor has no access to the data, leaves no third party to compel.
Who needs to assess it?
Any organization that stores regulated or sensitive data with a provider from another jurisdiction. Under the GDPR, transfers of personal data outside the European Economic Area require an assessment of whether the destination's laws undermine the protection the data should have, and foreign government access is central to that. Public bodies, critical infrastructure operators and companies holding trade secrets or defense-related data often face stricter expectations set by national guidance. The CLOUD Act and storage works through a concrete case.
Frequently asked questions
Does encryption stop extraterritorial access?
It makes the data unreadable if the provider does not hold the keys. If the provider manages the keys, it can be compelled to use them.
Is extraterritorial access only a US issue?
No. Several countries have laws with reach beyond their borders. The CLOUD Act is the most discussed because of the market share of US providers.
Does a local subsidiary change the position?
Not necessarily. If the parent company can obtain the data from its subsidiary, a court may treat the data as within the parent's control.
Related terms
- CLOUD Act: the US statute most often cited.
- Data localization: keeping data in a jurisdiction, which is not the same as control.
- Hold your own key (HYOK): keys kept outside the provider.
- GDPR: the regulation that requires transfer assessments.
- Third-party risk management (TPRM): where provider jurisdiction is assessed.