The US Cloud Act Explained: Why Your European Data on Google or Microsoft Servers Isn't Actually European

In March 2018, the United States Congress passed the Clarifying Lawful Overseas Use of Data Act, commonly known as the CLOUD Act. This legislation fundamentally changed the rules governing how US law enforcement agencies access data stored by American technology companies. For European businesses relying on Google Workspace, Microsoft 365, Amazon Web Services, or any other US-headquartered cloud provider, the implications are profound and largely misunderstood.

If your organization stores sensitive data with a US cloud provider, that data is potentially accessible to US authorities regardless of where the servers are physically located. Understanding this reality is the first step toward making informed decisions about your digital infrastructure.

What the CLOUD Act Actually Says

The CLOUD Act was signed into law on March 23, 2018, as part of an omnibus spending bill. Its core provision is straightforward: US-based service providers must comply with lawful requests for data from US law enforcement, regardless of where that data is physically stored.

This means that if a US company stores your data in a Frankfurt data center, on servers located within the European Union, US authorities can still compel that company to hand over your data through a warrant, subpoena, or court order.

Key Provisions

• Extraterritorial reach: US law enforcement can require any US-based company to provide stored communications and records regardless of the physical location of the data
• Executive agreements: The Act allows the US to enter into bilateral agreements with other countries, enabling reciprocal data access arrangements
• Motion to quash: Providers can challenge orders if they believe compliance would violate the laws of a qualifying foreign government, but the burden of proof is on the provider
• Applies to all US entities: Any company incorporated in the United States, or that has sufficient contacts with the US, falls under the Act's jurisdiction

The law was partly a response to the United States v. Microsoft Corp. case, where Microsoft fought a warrant seeking emails stored on servers in Ireland. The CLOUD Act rendered that legal battle moot by explicitly granting US authorities the power to compel data disclosure regardless of storage location.

How the CLOUD Act Conflicts with GDPR

The European Union's General Data Protection Regulation (GDPR) establishes strict rules about when and how personal data of EU residents can be transferred to third countries. Under GDPR, personal data can only be transferred outside the EU if the receiving country provides an adequate level of data protection, or if specific safeguards are in place.

The CLOUD Act creates a direct legal conflict. Here is where European organizations face an impossible situation:

This conflict means that a US cloud provider serving European customers is caught between two legal regimes. Complying with CLOUD Act demands may violate GDPR, and complying with GDPR may mean defying a US court order.

The Schrems II Decision and Its Aftermath

In July 2020, the Court of Justice of the European Union (CJEU) delivered its landmark ruling in Data Protection Commissioner v. Facebook Ireland, known as Schrems II. The court invalidated the EU-US Privacy Shield framework, finding that US surveillance laws, including the CLOUD Act, did not provide adequate protection for EU personal data.

The ruling sent shockwaves through the technology industry. Suddenly, the legal mechanism that thousands of companies relied on for EU-US data transfers was gone. While the court said that Standard Contractual Clauses (SCCs) could still be used, it placed a significant caveat: organizations must verify that the legal framework of the receiving country actually allows the data importer to comply with the clauses.

Given the findings of the CJEU regarding US surveillance practices, many legal scholars argue that SCCs alone cannot adequately protect EU personal data transferred to US-controlled infrastructure, because US law requires providers to hand over data regardless of contractual commitments.

The EU-US Data Privacy Framework

In July 2023, the European Commission adopted a new adequacy decision based on the EU-US Data Privacy Framework (DPF). However, privacy advocates have already signaled challenges. Max Schrems himself has indicated that the new framework does not address the fundamental issues raised in Schrems II. Many legal experts expect a "Schrems III" challenge, potentially invalidating this framework as well.

For businesses planning their data strategy, relying on a legal framework that may be struck down creates unacceptable uncertainty.

Why Standard Contractual Clauses Aren't Enough

After Schrems II, many organizations turned to Standard Contractual Clauses as their legal basis for data transfers. However, SCCs are contractual arrangements between private parties. They cannot override US federal law.

Consider the practical scenario:

1. Your organization signs SCCs with Google or Microsoft for data processing
2. The SCCs commit the provider to only process data according to your instructions
3. A US court issues a CLOUD Act order requiring the provider to hand over your data
4. The provider must comply with the court order, regardless of what the SCCs say
5. The provider may not even be able to tell you about the order due to gag provisions

SCCs provide a contractual commitment, but they cannot prevent a government from exercising its legal authority. This is why the European Data Protection Board (EDPB) has emphasized that organizations must conduct Transfer Impact Assessments and implement supplementary measures when relying on SCCs for transfers to the United States.

Real-World Enforcement and Documented Incidents

The CLOUD Act is not a theoretical concern. US authorities have actively used their power to access data stored overseas. While many specific cases remain sealed, several documented examples illustrate the scope:

• The original Microsoft Ireland case: Before the CLOUD Act resolved it legislatively, US authorities sought emails stored on Microsoft servers in Dublin, demonstrating the intent to access data regardless of location
• FISA Section 702 surveillance: Under the Foreign Intelligence Surveillance Act, US intelligence agencies collect vast amounts of data from US technology companies. The CLOUD Act complements this authority by ensuring data location is not a barrier
• National Security Letters: The FBI can issue NSLs compelling companies to provide customer data without judicial oversight, and these often come with gag orders preventing disclosure
• PRISM program disclosures: The Snowden revelations showed that US intelligence agencies had direct access to data from major US technology companies including Google, Microsoft, Apple, and others

The US Department of Justice has publicly stated that it considers the CLOUD Act an essential tool for law enforcement in the digital age. As of 2026, the US has entered executive agreements with several countries to facilitate cross-border data requests, further expanding the framework's practical reach.

What This Means for EU Businesses

For European organizations, the CLOUD Act creates several distinct risks:

Legal Risk

If a US provider hands your data to US authorities under a CLOUD Act order, you may be in violation of GDPR. Under GDPR Article 48, transfers of personal data to third-country authorities should only happen through mutual legal assistance treaties or similar international agreements. A unilateral CLOUD Act order does not meet this requirement.

Compliance Uncertainty

Even if no data is actually transferred, the mere possibility that it could be is enough to create compliance concerns. Data Protection Authorities in several EU member states have indicated that using US cloud services creates a GDPR risk that organizations must address in their Data Protection Impact Assessments.

Professional Privilege and Confidentiality

For organizations in regulated industries such as law, medicine, or finance, the CLOUD Act creates additional concerns. Attorney-client privilege, medical confidentiality, and banking secrecy may not be recognized or protected under US law in the same way they are under European law.

Competitive Intelligence Risk

For businesses operating in sectors where the US government has strategic interests, such as energy, defense, or technology, there is a legitimate concern that government access to business data could be used for purposes beyond law enforcement.

As we discuss in our complete guide to replacing Google and Microsoft with Nextcloud, understanding these legal risks is essential for making informed infrastructure decisions.

How to Avoid CLOUD Act Exposure

Eliminating CLOUD Act risk requires a fundamental shift in how you approach cloud infrastructure. Here are the key strategies:

1. Use Non-US Providers

The most straightforward approach is to use cloud services from companies that are not subject to US jurisdiction. This means providers that are incorporated outside the United States and do not have sufficient contacts with the US to fall under CLOUD Act jurisdiction. European-headquartered providers operating European infrastructure provide the strongest protection.

2. Self-Host on European Infrastructure

Self-hosting your collaboration tools on European infrastructure gives you the maximum level of control. When you operate your own instance of an open-source platform, there is no US service provider in the chain that could be compelled to hand over your data.

3. Implement End-to-End Encryption

Even if data were to be accessed, end-to-end encryption ensures that the content is unreadable without your encryption keys. However, encryption alone is not a complete solution since metadata, access patterns, and other information may still be exposed.

4. Conduct a Thorough Data Mapping

Understand exactly where your data flows. Many organizations discover that even if their primary cloud provider is European, they use US-based sub-processors, plugins, or integrations that create CLOUD Act exposure.

For a deeper look at how to set up GDPR-compliant Nextcloud infrastructure, our deployment guide covers the technical specifics. You may also want to explore our European datacenter hosting guide for choosing the right location for your deployment.

Nextcloud on European Infrastructure: The Complete Solution

Nextcloud represents the most comprehensive approach to eliminating CLOUD Act exposure for your collaboration and file-sharing needs. As an open-source platform developed by a German company (Nextcloud GmbH), it is not subject to US jurisdiction. When deployed on European infrastructure, the entire data chain remains outside US legal reach.

Why Nextcloud Eliminates CLOUD Act Risk

• Open-source software: No proprietary vendor can be compelled to provide backdoor access
• Self-hosted deployment: You control the infrastructure, so there is no US service provider in the equation
• European development: Nextcloud GmbH is headquartered in Stuttgart, Germany, and subject only to European law
• Full data sovereignty: Your encryption keys, your servers, your rules
• No telemetry or data collection: Unlike Google or Microsoft, Nextcloud does not phone home with your usage data

Understanding how major cloud providers actually handle your business data is equally important. Read our analysis of what Google Workspace terms of service actually say about your business data, and learn about Microsoft 365's telemetry and data collection practices to get the full picture of what you are agreeing to when you use these services.

Practical Steps for European Organizations

If you are ready to address CLOUD Act risk in your organization, here is a practical roadmap:

1. Audit your current providers: Identify every US-headquartered service that processes your data
2. Classify your data: Determine which data categories are most sensitive and most at risk
3. Evaluate alternatives: For each US service, identify European or self-hosted alternatives
4. Plan your migration: Start with the most sensitive data categories and work outward
5. Implement monitoring: Establish ongoing oversight to ensure new US services are not introduced inadvertently
6. Document everything: Maintain records of your risk assessment and mitigation efforts for regulatory purposes

Conclusion

The CLOUD Act represents a fundamental challenge to European data sovereignty. As long as your data is processed by a US-headquartered company, it is potentially accessible to US authorities, regardless of where the servers are physically located, what contractual clauses you have in place, or what your data protection policies say.

For European organizations serious about data protection, the path forward is clear: move sensitive workloads to infrastructure that is entirely outside US jurisdiction. Self-hosted Nextcloud on European infrastructure provides a complete collaboration suite without any CLOUD Act exposure, giving you genuine data sovereignty rather than the illusion of it.

The question is not whether the CLOUD Act affects your organization. If you use any US cloud service, it already does. The question is what you are going to do about it.