Does the CLOUD Act apply to data in EU data centres?

Yes, if the provider is subject to US jurisdiction. 18 U.S.C. § 2713 obliges providers to disclose data in their possession, custody or control, regardless of whether it is stored inside or outside the United States. The location of the data centre alone therefore does not protect against a disclosure order addressed to a US provider.

Is the EU–US Data Privacy Framework still valid?

Yes. The European Commission adopted the adequacy decision on 10 July 2023, and the General Court dismissed the action against it on 3 September 2025. An appeal against that judgment was lodged with the Court of Justice on 31 October 2025 (C-703/25 P). As of early October 2026, we are not aware of a ruling on it.

Do I need a transfer impact assessment?

If you transfer personal data to a third country on the basis of standard contractual clauses, yes: under the EDPB’s Recommendations 01/2020 you assess the law and practice of the destination country. Remote access from a third country, for example in support, also counts as a transfer. For transfers to DPF-certified US companies, you rely on the adequacy decision instead.

Does encryption protect against the CLOUD Act?

Only if the provider does not hold the keys. The EDPB recognises encryption as an effective supplementary measure when the keys are held solely by the data exporter or a trusted party in the EEA. If the provider has to process the data in the clear, as with a running application, the EDPB sees no effective technical measure.

Is a European cloud provider enough for the GDPR?

It takes one big question off the table but does not replace the other obligations: a data processing agreement, a sub-processor list, technical and organisational measures. Check whether the contract rules out any processing in third countries and whether the provider’s own sub-processors are based in the EU as well.

← Back to the blog

SecurityOctober 26, 2026Florian Apel

CLOUD Act and GDPR: what your choice of cloud provider means for SaaS

“But the data is in Germany” does not answer the CLOUD Act question. What the US law allows, where the Data Privacy Framework stands, and what SaaS companies should check when choosing a cloud provider.

Compliance Scaleway

Cover image: CLOUD Act and GDPR: what your choice of cloud provider means for SaaS

Before signing, a large customer sends a SaaS company an information security questionnaire. Question 14: “Is any of your sub-processors subject to the US CLOUD Act?” The application runs in Frankfurt on a US hyperscaler. “But the data is in Germany,” says the CTO – and realises while typing that this does not answer the question.

The CLOUD Act is a US law from 2018 that obliges providers under US jurisdiction to hand over data when ordered to by US authorities, even if it is stored outside the United States. This article sets out what that means, together with the GDPR, for your choice of cloud provider. It relies on primary sources and is not legal advice.

What does the CLOUD Act allow?

The Clarifying Lawful Overseas Use of Data Act has been in force since March 2018. Its core is 18 U.S.C. § 2713: providers of electronic communication and remote computing services must disclose content and records in their possession, custody or control, regardless of whether that data is located inside or outside the United States.

What matters, then, is not where the servers stand but who has access to the data and which law they are subject to. An EU region of a US provider does not settle that. On the other side stands Article 48 GDPR: judgments and decisions of a third country’s authorities requiring disclosure are only recognised on the basis of an international agreement. A provider can end up caught between two legal systems.

Where do Schrems II and the Data Privacy Framework come in?

On 16 July 2020, the Court of Justice of the EU declared the EU–US Privacy Shield invalid in its Schrems II judgment (C-311/18): US surveillance programmes were not limited to what is strictly necessary, and data subjects had no actionable rights before the courts. Standard contractual clauses remained valid – but whoever exports data has to check whether they can be complied with in the destination country.

On 10 July 2023, the European Commission adopted a new adequacy decision, the EU–US Data Privacy Framework (DPF). It rests on an Executive Order of October 2022 with new limits on US intelligence agencies and on a Data Protection Review Court for complaints. It covers transfers to US companies that have certified under the framework.

On 3 September 2025, the General Court dismissed the action brought against the decision by Philippe Latombe, a French citizen (T-553/23): when it was adopted, the US ensured an adequate level of protection. Latombe appealed to the Court of Justice on 31 October 2025 (C-703/25 P); as of early October 2026 we are not aware of a ruling. So the DPF applies – in the knowledge that the Court of Justice struck down both of its predecessors.

What should SaaS companies check when choosing?

Your cloud provider is a sub-processor under Article 28 GDPR: it may only be engaged with your customers’ authorisation, and it appears on your list. Five points belong on the checklist:

The data processing agreement. Place of processing, technical and organisational measures, rules for further sub-processors – in writing, not just on a marketing page.
The sub-processor list. Not only the host counts, but also email delivery, the support tool, monitoring and the CDN. A single US service in the chain brings the transfer question back.
The transfer impact assessment. If you transfer data to a third country on the basis of standard contractual clauses, the European Data Protection Board’s Recommendations 01/2020 require you to assess the law and practice of the destination country and add supplementary measures where needed. Remote access from a third country, for example in support, also counts as a transfer.
Encryption and key control. According to the EDPB, encryption is an effective supplementary measure only if the keys are held solely by the data exporter or a trusted party in the EEA. If the provider needs the data in the clear – as every running application does – the EDPB sees no effective technical measure.
The provider’s domicile. If the provider is established in the EEA and its contract rules out any processing in third countries, the EDPB no longer requires you to map where that cloud transfers data. The CLOUD Act is aimed at providers under US jurisdiction, so also ask about US branches or a US parent and about the provider’s own sub-processors. Authorities can request data in the EU too – then under the law of the EU and its member states, with the remedies that come with it.

If you are considering a move, the process is under Moving from AWS, Azure or Google Cloud; what sovereignty means beyond the law, under Digital sovereignty.

How is Clusterward set up?

We built Clusterward so that question 14 has a short answer:

Your clusters, databases and buckets run in your own Scaleway project, under your own contract with Scaleway. For that infrastructure, Scaleway is your processor, not ours.
The Clusterward platform runs on Scaleway in Amsterdam, and Scaleway sends our emails from Paris. Scaleway SAS, headquartered in Paris, is our only sub-processor. No transfer to third countries takes place; support and operations with access to personal data happen only from within the EU.
Every workspace has its own database and its own data key; cloud and cluster keys are encrypted with AES-256-GCM and cannot be read back once saved.
Services you connect with your own credentials, such as GitHub or Cloudflare DNS, are your own processors – with their own transfer question.

The details are in the data processing agreement. The legal assessment stays with you; the facts for it are in writing.

Conclusion

The CLOUD Act follows control over data, not its location. The Data Privacy Framework allows transfers to certified US companies but is once again before the Court of Justice. For SaaS companies that means: know your sub-processors, assess transfers, judge key control soberly – and choose a provider that keeps as many of these questions as possible from arising at all.

A customer questionnaire on your desk? Send us the questions on hosting and sub-processors. We will tell you which of them Clusterward answers with facts. Ask a question →

Sources and further reading

Frequently asked questions

Yes, if the provider is subject to US jurisdiction. 18 U.S.C. § 2713 obliges providers to disclose data in their possession, custody or control, regardless of whether it is stored inside or outside the United States. The location of the data centre alone therefore does not protect against a disclosure order addressed to a US provider.