Cyberpediaby Brain
ENDEFR

Cloud Act, FISA and data sovereignty

US laws can open access to data hosted in Europe. What the GDPR says, what the EU-US framework changes, and SecNumCloud.

In 30 seconds

Where it happens
In any cloud service (storage, messaging, online office tools) provided by a supplier subject to a non-European law, even if the servers are in Europe1.
What the law provides
The GDPR recognises a decision by a third-country authority demanding data only if it rests on an international agreement, such as a mutual legal assistance treaty3.
What France offers
Version 3.2 of ANSSI's SecNumCloud standard includes protection requirements against these laws1.
The reflex
Before putting data into a cloud tool, check that it is provided or approved by the company, and ask the IT department or the data protection officer which data may go there.

What it is

When a company entrusts its files, messages or software to a cloud service, it also chooses, often without noticing, the law that governs that data. CERT-FR, which is attached to ANSSI, notes that some hosting providers are subject to legislation such as the American Cloud Act and FISA, which allow the authorities of that country to access data stored in the cloud, including outside their territory1.

The Senate report states that "the American giants are bound to apply extraterritorial sanctions regimes or rules on access to electronic evidence (such as the Cloud Act)"2. This page explains what this changes for an employee and for management.

Straight answers

Is data hosted in Europe safe from American laws?

Not necessarily. According to CERT-FR, these laws allow American authorities to access data stored in the cloud, including outside their territory1. The CNIL describes a risk for data stored by a company subject to non-European law, such as hosting providers whose parent company is in the United States5.

Can the provider warn its customer?

CERT-FR describes laws that require hosting providers to hand their customers' data to their authorities, with no means of appeal and without informing the customers1.

Is encryption enough?

No, according to CERT-FR. It does not offer adequate protection if the encryption keys are also in the cloud, which is generally the case when the encrypted data is processed in the cloud and not just stored1.

What does the GDPR say?

Article 48 rules out automatic recognition of a foreign decision: it can be recognised or made enforceable only if it is based on an international agreement in force between the requesting country and the Union or a Member State3.

Is the United States an "adequate" country?

For companies that take part in the Data Privacy Framework, yes. The European Commission adopted its adequacy decision on a 10 July, and personal data can flow freely from the EU to these companies4. The CNIL dates this decision to 10 July 20235.

1What it changes for employees1 min

The employee does not have to judge which law applies: the role is to avoid bypassing the tools chosen by the company. A personal or free cloud service, used for a work document, escapes the choice of hosting provider, the classification of data and the contract that management may have negotiated.

CERT-FR also points out that, in the cloud, customers of cloud services have significant responsibilities in managing data and identities1. An employee who shares a file or uploads a document is acting on the company's data.

Two habits follow: use the tools that are provided or approved, and report to the IT department any cloud use that has not been approved; ask before putting large databases of health data, offence data or minors' data there, which the CNIL lists among sensitive data5.

2What it changes for managementManagement1 min

The choice of hosting provider becomes a legal decision as much as a technical one. CERT-FR writes that it is indispensable to assess these risks case by case1.

For the most sensitive processing, the CNIL recommends using a provider that is subject exclusively to European law and offers the adequate level of protection5. CERT-FR points to a second risk. A service provided by a foreign supplier may be subject to export restrictions or sanctions, which can change over time, which affects the availability of data and applications1.

3What the text saysOfficial text2 min

Chapter V of the GDPR governs transfers of personal data to third countries. Article 44 sets the principle: a transfer takes place only if the conditions of the chapter are met, so that the level of protection guaranteed by the regulation is not undermined3.

The chapter provides several routes. The Commission's adequacy decision requires no specific authorisation (Article 45)3. In its absence, appropriate safeguards are possible: binding corporate rules or standard data protection clauses, among others (Article 46)3. Derogations exist for particular situations, such as the explicit consent of the person concerned (Article 49)3.

Article 48 deals with the specific case of a foreign order: a decision of a court or administrative authority of a third country requiring a transfer or disclosure of data can be recognised or made enforceable only if it rests on an international agreement, such as a mutual legal assistance treaty3.

On the American side, the Commission explains that adequacy followed a presidential executive order of 7 October and a regulation of the US Attorney General. These texts introduced binding safeguards to respond to the Schrems II judgment of the Court of Justice of the European Union of July 2020: access by intelligence agencies limited to what is necessary and proportionate, and an independent redress mechanism for complaints from Europeans4. These safeguards apply to all transfers to American companies, whatever the transfer tool used4.

On the French side, version 3.2 of ANSSI's SecNumCloud standard includes protection requirements against the application of these extraterritorial laws1. The CNIL states that this certification allows protection against access by foreign authorities5.

4Where implementation stands1 min

The adequacy decision on the Data Privacy Framework is adopted and applies to participating American companies4. The GDPR provides for a periodic review of an adequacy decision at least every four years, and the Commission may repeal, amend or suspend it if the level of protection is no longer adequate3.

The European EUCS certification was still a draft in July 2024. At that date, the CNIL observed that the project led by ENISA no longer made it possible to ensure that the hosting provider is not subject to non-European legislation, even at the highest levels and even on an optional basis5. It called for reintroducing criteria of immunity from non-European laws, inspired by SecNumCloud5. This question was to be discussed again as soon as the new European Commission was constituted5. In France, the law of 21 May cited by the CNIL, known as the SREN law, provides that, for data of particular sensitivity for the State, the cloud service must implement security and data protection criteria to prevent any access by public authorities of third States that is not authorised by Union or Member State law5. The "Cloud au centre" doctrine, for its part, asks public authorities to ensure that data "of particular sensitivity" hosted in the cloud is not subject to non-European laws5.

Fact sheet

Identifier
CP-374
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-039
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. CERT-FR (ANSSI), “Cloud computing : état de la menace informatique”, 19 February 2025. https://cert.cyber.gouv.fr/uploads/CERTFR-2025-CTI-001.pdf (accessed 3 November 2026)
  2. Senate (France), “Le devoir de souveraineté numérique”, 1 October 2019. https://www.senat.fr/rap/r19-007-1/r19-007-13.html (accessed 3 November 2026)
  3. CNIL, “CHAPITRE V - Transferts de données à caractère personnel vers des pays tiers ou à des organisations internationales”. https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre5 (accessed 3 November 2026)
  4. European Commission, “EU-US data transfers”. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en (accessed 3 November 2026)
  5. CNIL, “Cloud : les risques d'une certification européenne permettant l'accès des autorités étrangères aux données sensibles”, 19 July 2024. https://www.cnil.fr/fr/cloud-les-risques-dune-certification-europeenne-permettant-lacces-des-autorites-etrangeres (accessed 3 November 2026)

Cite this article

Brain, “Cloud Act, FISA and data sovereignty”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/

BibTeX 
@misc{brain_cp374_en_2026,
  author = {Brain},
  title = {Cloud Act, FISA and data sovereignty},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/cloud-act-fisa-702-data-sovereignty/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence