--- id: CP-374 slug: cloud-act-fisa-702-data-sovereignty lang: en title: Cloud Act, FISA and data sovereignty description: US laws can open access to data hosted in Europe. What the GDPR says, what the EU-US framework changes, and SecNumCloud. canonical_url: https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/ markdown_url: https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Cloud Act, FISA and data sovereignty", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-039 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/ fr: https://startbrain.io/cyberpedia/fr/articles/cloud-act-fisa-702-souverainete-donnees/ de: https://startbrain.io/cyberpedia/de/articles/cloud-act-fisa-702-datensouveranitaet/ es: https://startbrain.io/cyberpedia/es/articles/cloud-act-fisa-702-soberania-datos/ sources: - "n": 1 title: "Cloud computing : état de la menace informatique" publisher: CERT-FR (ANSSI) url: https://cert.cyber.gouv.fr/uploads/CERTFR-2025-CTI-001.pdf published: "2025-02-19" accessed: "2026-11-03" - "n": 2 title: Le devoir de souveraineté numérique publisher: Senate (France) url: https://www.senat.fr/rap/r19-007-1/r19-007-13.html published: "2019-10-01" accessed: "2026-11-03" - "n": 3 title: CHAPITRE V - Transferts de données à caractère personnel vers des pays tiers ou à des organisations internationales publisher: CNIL url: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre5 accessed: "2026-11-03" - "n": 4 title: EU-US data transfers publisher: European Commission url: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en accessed: "2026-11-03" - "n": 5 title: "Cloud : les risques d'une certification européenne permettant l'accès des autorités étrangères aux données sensibles" publisher: CNIL url: https://www.cnil.fr/fr/cloud-les-risques-dune-certification-europeenne-permettant-lacces-des-autorites-etrangeres published: "2024-07-19" accessed: "2026-11-03" --- # Cloud Act, FISA and data sovereignty When a company entrusts its files, messages or software to a cloud service, it also chooses, often without noticing, the law that governs that data. CERT-FR, which is attached to ANSSI, notes that some hosting providers are subject to legislation such as the American Cloud Act and FISA, which allow the authorities of that country to access data stored in the cloud, including outside their territory [1]. The Senate report states that "the American giants are bound to apply extraterritorial sanctions regimes or rules on access to electronic evidence (such as the Cloud Act)" [2]. This page explains what this changes for an employee and for management. ## In 30 seconds - Where it happens: in any cloud service (storage, messaging, online office tools) provided by a supplier subject to a non-European law, even if the servers are in Europe [1]. - What the law provides: the GDPR recognises a decision by a third-country authority demanding data only if it rests on an international agreement, such as a mutual legal assistance treaty [3]. - What France offers: version 3.2 of ANSSI's SecNumCloud standard includes protection requirements against these laws [1]. - The reflex: before putting data into a cloud tool, check that it is provided or approved by the company, and ask the IT department or the data protection officer which data may go there. ## Straight answers ### Is data hosted in Europe safe from American laws? Not necessarily. According to CERT-FR, these laws allow American authorities to access data stored in the cloud, including outside their territory [1]. The CNIL describes a risk for data stored by a company subject to non-European law, such as hosting providers whose parent company is in the United States [5]. ### Can the provider warn its customer? CERT-FR describes laws that require hosting providers to hand their customers' data to their authorities, with no means of appeal and without informing the customers [1]. ### Is encryption enough? No, according to CERT-FR. It does not offer adequate protection if the encryption keys are also in the cloud, which is generally the case when the encrypted data is processed in the cloud and not just stored [1]. ### What does the GDPR say? Article 48 rules out automatic recognition of a foreign decision: it can be recognised or made enforceable only if it is based on an international agreement in force between the requesting country and the Union or a Member State [3]. ### Is the United States an "adequate" country? For companies that take part in the Data Privacy Framework, yes. The European Commission adopted its adequacy decision on a 10 July, and personal data can flow freely from the EU to these companies [4]. The CNIL dates this decision to 10 July 2023 [5]. ## What it changes for employees The employee does not have to judge which law applies: the role is to avoid bypassing the tools chosen by the company. A personal or free cloud service, used for a work document, escapes the choice of hosting provider, the classification of data and the contract that management may have negotiated. CERT-FR also points out that, in the cloud, customers of cloud services have significant responsibilities in managing data and identities [1]. An employee who shares a file or uploads a document is acting on the company's data. Two habits follow: use the tools that are provided or approved, and report to the IT department any cloud use that has not been approved; ask before putting large databases of health data, offence data or minors' data there, which the CNIL lists among sensitive data [5]. ## What it changes for management The choice of hosting provider becomes a legal decision as much as a technical one. CERT-FR writes that it is indispensable to assess these risks case by case [1]. For the most sensitive processing, the CNIL recommends using a provider that is subject exclusively to European law and offers the adequate level of protection [5]. CERT-FR points to a second risk. A service provided by a foreign supplier may be subject to export restrictions or sanctions, which can change over time, which affects the availability of data and applications [1]. ## What the text says Chapter V of the GDPR governs transfers of personal data to third countries. Article 44 sets the principle: a transfer takes place only if the conditions of the chapter are met, so that the level of protection guaranteed by the regulation is not undermined [3]. The chapter provides several routes. The Commission's adequacy decision requires no specific authorisation (Article 45) [3]. In its absence, appropriate safeguards are possible: binding corporate rules or standard data protection clauses, among others (Article 46) [3]. Derogations exist for particular situations, such as the explicit consent of the person concerned (Article 49) [3]. Article 48 deals with the specific case of a foreign order: a decision of a court or administrative authority of a third country requiring a transfer or disclosure of data can be recognised or made enforceable only if it rests on an international agreement, such as a mutual legal assistance treaty [3]. On the American side, the Commission explains that adequacy followed a presidential executive order of 7 October and a regulation of the US Attorney General. These texts introduced binding safeguards to respond to the Schrems II judgment of the Court of Justice of the European Union of July 2020: access by intelligence agencies limited to what is necessary and proportionate, and an independent redress mechanism for complaints from Europeans [4]. These safeguards apply to all transfers to American companies, whatever the transfer tool used [4]. On the French side, version 3.2 of ANSSI's SecNumCloud standard includes protection requirements against the application of these extraterritorial laws [1]. The CNIL states that this certification allows protection against access by foreign authorities [5]. ## Where implementation stands The adequacy decision on the Data Privacy Framework is adopted and applies to participating American companies [4]. The GDPR provides for a periodic review of an adequacy decision at least every four years, and the Commission may repeal, amend or suspend it if the level of protection is no longer adequate [3]. The European EUCS certification was still a draft in July 2024. At that date, the CNIL observed that the project led by ENISA no longer made it possible to ensure that the hosting provider is not subject to non-European legislation, even at the highest levels and even on an optional basis [5]. It called for reintroducing criteria of immunity from non-European laws, inspired by SecNumCloud [5]. This question was to be discussed again as soon as the new European Commission was constituted [5]. In France, the law of 21 May cited by the CNIL, known as the SREN law, provides that, for data of particular sensitivity for the State, the cloud service must implement security and data protection criteria to prevent any access by public authorities of third States that is not authorised by Union or Member State law [5]. The "Cloud au centre" doctrine, for its part, asks public authorities to ensure that data "of particular sensitivity" hosted in the cloud is not subject to non-European laws [5]. ## Sources 1. CERT-FR (ANSSI), "Cloud computing : état de la menace informatique", 19 February 2025. https://cert.cyber.gouv.fr/uploads/CERTFR-2025-CTI-001.pdf (accessed 3 November 2026) 2. Senate (France), "Le devoir de souveraineté numérique", 1 October 2019. https://www.senat.fr/rap/r19-007-1/r19-007-13.html (accessed 3 November 2026) 3. CNIL, "CHAPITRE V - Transferts de données à caractère personnel vers des pays tiers ou à des organisations internationales". https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre5 (accessed 3 November 2026) 4. European Commission, "EU-US data transfers". https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en (accessed 3 November 2026) 5. CNIL, "Cloud : les risques d'une certification européenne permettant l'accès des autorités étrangères aux données sensibles", 19 July 2024. https://www.cnil.fr/fr/cloud-les-risques-dune-certification-europeenne-permettant-lacces-des-autorites-etrangeres (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.