What Is the US CLOUD Act?

The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act), signed into law on 23 March 2018 as Division V of the Consolidated Appropriations Act, 2018, is a United States law that lets US authorities compel communication and cloud service providers subject to US jurisdiction to hand over data in their possession, custody, or control, regardless of whether that data is stored inside or outside the United States. In practice, it means data held by a US company can be reached by US legal process even when it sits in a data center in Frankfurt, Dublin, or elsewhere.

For European organizations, the CLOUD Act is the concrete reason that storing data in an EU region is not the same as keeping it beyond foreign reach. It is central to the debate about data sovereignty, and it is one of the main drivers behind Europe's push for sovereign infrastructure.

What the US CLOUD Act Is

The CLOUD Act updated the 1986 Stored Communications Act, which sets the rules for when the US government can compel providers to produce stored electronic communications. Before the Act, there was legal doubt about whether a US warrant could reach data stored abroad. In the Microsoft Ireland case, a federal appeals court had held in 2016 that a Stored Communications Act warrant could not reach emails Microsoft stored in Dublin. The CLOUD Act settled the question in the government's favor, and on 17 April 2018 the Supreme Court dismissed United States v. Microsoft Corp. as moot, because the new law applied and the government had obtained a new warrant under it. What matters now is not where the data sits, but whether a provider subject to US jurisdiction controls it.

It applies to providers subject to US jurisdiction, which includes US-headquartered companies and, depending on the control they hold, their subsidiaries. The trigger is control over the data, not the data's location.

How It Works

The mechanism is straightforward and that is exactly why it matters:

• A US authority issues a lawful order (a warrant or subpoena) for specific data.
• The order is served on a provider subject to US jurisdiction that has possession, custody, or control of that data.
• The provider must produce the data, whether it is stored in the US or in an EU region. Geography does not shield it.

The obligation is not absolute. Under 18 U.S.C. 2703(h), a provider can ask a court to quash or modify an order for the content of a customer who is not a US person and does not live in the US, but only where disclosure would risk violating the law of a "qualifying foreign government", meaning a country that has a CLOUD Act executive agreement in force with the US and whose law gives US providers reciprocal protections. The court then weighs comity factors such as the interests of both governments and the penalties the provider faces. The Act also left the existing common-law comity arguments available in other cases.

The Act created that framework of executive agreements to streamline cross-border requests in both directions. The agreement with the United Kingdom entered into force in October 2022 and the one with Australia in January 2024; the US Department of Justice publishes the agreement texts. EU-US negotiations on access to electronic evidence opened in 2019 and resumed in March 2023, but as of October 2026 no EU-US agreement has been concluded. The core obligation on providers subject to US jurisdiction stands regardless of any such agreement.

The Conflict with GDPR

The CLOUD Act puts European organizations in a genuine bind. If a US provider discloses EU personal data to US authorities under a CLOUD Act order, that disclosure can itself breach the GDPR. Under Article 48 of the GDPR, a judgment or decision by a third-country authority does not, on its own, make a transfer of personal data lawful; such a judgment or decision can be recognised or enforced only if based on an international agreement, such as a mutual legal assistance treaty, without prejudice to the other transfer grounds in Chapter V, such as the narrow derogations in Article 49.

The European Data Protection Board and the European Data Protection Supervisor took a restrictive view in a joint legal assessment for the European Parliament in July 2019: a CLOUD Act order is not by itself a legal basis under the GDPR, so a provider subject to the GDPR that discloses personal data in response to a direct request risks breaching it. They called for an EU-US international agreement with strong safeguards as the appropriate route. The result is a conflict of laws, obey the US order and risk GDPR penalties, or follow GDPR and risk US non-compliance, that no amount of contractual language fully resolves.

The conflict is not limited to personal data. Article 32 of the EU Data Act, which applies from 12 September 2025, requires cloud and other data processing service providers to take technical, organisational and legal measures against third-country government access to non-personal data held in the EU where that access would conflict with EU or national law.

What It Means for EU Organizations

The practical lesson is that jurisdiction, not geography, decides who can reach your data. A data catalog is a sensitive example: it describes what data you hold, where it flows, and who owns it, exactly the kind of map you do not want exposed to a foreign order. Choosing where that catalog runs, and who operates it, is a sovereignty decision.

This is why residency alone does not solve the problem, and why interest in sovereign cloud and European-operated infrastructure has grown. The most direct way out of the conflict is to ensure that the provider holding your data, and the infrastructure provider underneath it, is not subject to US jurisdiction in the first place, and that the data can run in an environment you control.

How Dawiso Fits

Dawiso gives you a choice of where your governed metadata lives and who operates it, so you can decide how much CLOUD Act exposure to accept.

• A European vendor. Dawiso is built by a European company headquartered in Prague, so the software vendor itself is not a US company.
• Deploy where you control it. Dawiso runs as SaaS on Microsoft Azure, in a private cloud in your own cloud tenant, or fully on-premise. The infrastructure matters as much as the vendor: a US cloud provider is itself subject to the CLOUD Act, so teams that want to remove that exposure run Dawiso fully on-premise.
• Metadata first, isolated per customer. In hybrid setups only metadata, plus any data samples you choose to enable, is transferred to the Dawiso cloud catalog, and each customer has a separate metadata store.
• Governance that supports compliance. The data catalog, classification labels your stewards apply, and lineage help you document where personal and sensitive data sits and how it flows, the picture that GDPR and the EU Data Act assume you have.

The wider case is in European data sovereignty and the data catalog.

Conclusion

The US CLOUD Act lets US authorities compel US-based providers to disclose data wherever it is stored, which is why EU residency on a US-operated platform does not put data beyond reach. It collides with the GDPR, leaving European organizations in a conflict of laws that contracts cannot fully fix, and no EU-US agreement has yet resolved it. The most direct answer is sovereignty: keep your most sensitive systems, your data catalog included, with a European provider, on infrastructure outside US jurisdiction, running where you control it.

Sources

• US Congress, H.R. 1625, Consolidated Appropriations Act, 2018 (Division V, the CLOUD Act).
• Legal Information Institute, 18 U.S. Code 2713, Required preservation and disclosure of communications and records.
• Legal Information Institute, 18 U.S. Code 2703, Required disclosure of customer communications or records (comity analysis, subsection (h)).
• Legal Information Institute, United States v. Microsoft Corp., 584 U.S. ___ (2018).
• US Department of Justice, CLOUD Act Resources (executive agreements).
• US Department of Justice - Landmark U.S.-UK Data Access Agreement Enters into Force.
• US Department of Justice - Joint Statement by U.S. Attorney General Merrick B. Garland and Australia Attorney-General Mark Dreyfus KC.
• European Commission, EU-US announcement on the resumption of negotiations on an EU-US agreement to facilitate access to electronic evidence.
• GDPR Article 48, Transfers or disclosures not authorised by Union law.
• GDPR Article 49, Derogations for specific situations.
• European Data Protection Board, EDPB-EDPS Joint Response to the LIBE Committee on the impact of the US Cloud Act on the European legal framework for personal data protection.
• Publications Office of the EU (EUR-Lex), Regulation (EU) 2023/2854, Data Act (Article 32).