The CLOUD Act and your European data: does hosting in Europe help?
Short answer
The CLOUD Act is a 2018 US law that lets US authorities require a US provider to hand over data in its possession, custody or control, even when that data is stored in Europe. Hosting in a European datacentre of a US company therefore does not remove the risk. What does help: data held by a party not subject to US law, or on infrastructure you run yourself.
What does the CLOUD Act do?
The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was passed in the United States in 2018. It provides that a US provider of communication or cloud services must disclose data under a valid US order if that data is in its “possession, custody, or control”. Where the data is physically stored does not matter.
The law gives providers a limited possibility to challenge such an order when it conflicts with another country’s law, and provides for agreements between the US and other states. But the main rule stands: whoever is subject to US law can be compelled to deliver data, including from a European datacentre.
Why a European datacentre is not enough
Many US cloud providers offer storage in Europe, and some a “sovereign” variant with European operators. That reduces risks, but does not solve the core point: as long as the parent company is subject to US law, an order can reach the group.
Microsoft confirmed this itself. In June 2025 the legal director of Microsoft France stated under oath before the French Senate that he could not guarantee that French citizens’ data would never be handed to US authorities without the French authorities’ consent. He added that it had not happened in practice. See also Microsoft 365 Copilot or your own AI environment?
There are also US intelligence powers, such as section 702 of FISA. In 2020 they were the reason the Court of Justice of the EU struck down the Privacy Shield in Schrems II. The current EU-US Data Privacy Framework is again before the Court.
Why this weighs heavier with AI
With storage, it is about files you deliberately put somewhere. With AI, it is about everything staff put into a prompt: contracts, patient letters, strategy papers, client files. That content is processed, and often logged, by the AI vendor. The largest AI vendors are American. For ChatGPT specifically, see Is ChatGPT GDPR-compliant?
For organisations with professional secrecy, special-category data or a supervisor that sets outsourcing requirements, that is a concrete risk that belongs in the DPIA. See A DPIA for generative AI.
What does help?
| Measure | Effect on the CLOUD Act risk |
|---|---|
| Storage in a European datacentre of a US provider | Limited: the group remains subject to US law |
| Encryption with keys only you control | Strong for storage; with AI the text must be decrypted to be processed |
| A European provider without a US parent | Large, if there are no US subcontractors in the chain either |
| Your own infrastructure, your own operations | The largest: there is no provider to compel, because nobody else has the data |
For AI, the last row means open-weight models on a node of your own. With werqly that node sits in your server room, and the models run there and nowhere else. If you have no server room, the node sits in a locked rack in our European datacentre, for you alone. See What is private AI?
Frequently asked questions
Questions on this topic
Does the CLOUD Act apply to data in Europe?
Yes, if the data is in the possession, custody or control of a provider subject to US law. The physical location is not decisive. A European datacentre of a US group therefore does not remove the risk.
Does the CLOUD Act conflict with the GDPR?
A conflict can arise: the GDPR only allows a transfer based on a foreign order through an international agreement or another GDPR basis. A provider can then be caught between two legal systems. For you as controller, it is a risk to assess in the DPIA.
Does a sovereign cloud from a US provider help?
It reduces risks, for example through European operators and a European entity. As long as the parent company is subject to US law, a residual risk remains. How large depends on the legal and technical set-up; have it assessed per provider.
Is werqly subject to the CLOUD Act?
werqly is part of the Dutch company TIMA Labs. More importantly: with a node in your own server room, werqly does not hold the content of prompts and documents. The models run on your hardware, so there is nothing a foreign authority can obtain through werqly.
Sources
- U.S. Department of Justice — The CLOUD Act (resources)
- Court of Justice of the EU — Press release Schrems II (C-311/18), July 2020
- The Register — Microsoft admits it “cannot guarantee” data sovereignty (July 2025)
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.