---
title: "CLOUD Act"
url: "https://mahouse.world/glossary/cloud-act"
type: "glossary term"
author: "Ihor Vlasov"
reviewed: "2026-09-30"
published: "2026-09-25"
---

# CLOUD Act

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a 2018 US federal law requiring providers of communication and cloud services to disclose customer data in their possession, custody or control in response to valid US legal process, wherever that data is stored. It also lets the US sign data-access agreements with foreign governments that meet its privacy standards.

**Also known as:** Clarifying Lawful Overseas Use of Data Act, CLOUD Act 2018, H.R. 4943

## Key facts

- **Enacted:** 23 March 2018, as part of the Consolidated Appropriations Act, 2018; it amended the Stored Communications Act of 1986
- **Origin:** the Microsoft Ireland case, in which Microsoft refused an SCA warrant for emails stored on servers in Ireland; in April 2018 the Supreme Court vacated the case as moot after a new warrant was obtained under the Act
- **Scope and challenge:** data in a provider's "possession, custody, or control" is covered regardless of location; a provider may move to quash within 14 days where the customer is not a US person, does not reside in the US, and disclosure would risk breaching the laws of a "qualifying foreign government" — one with an agreement in force; common-law comity arguments are preserved for other cases
- **Agreements:** with the UK (signed October 2019) and Australia (signed December 2021); negotiations with Canada announced in 2022, and US–EU talks on electronic evidence resumed in 2023
- **Conflict:** Article 48 of the GDPR recognises a third country's order to transfer personal data only where it rests on an international agreement, such as a mutual legal assistance treaty

## How the CLOUD Act works in practice

The Act matters to any business that stores regulated data with a US-headquartered cloud, email or software provider — for most European banks, payment firms and AI companies, their main infrastructure. Choosing an EU data centre changes where data sits, not who controls it: a provider served with valid process must produce what it controls, wherever it is. The Act concerns law-enforcement demands under the Stored Communications Act; intelligence surveillance, such as under FISA, rests on separate law.

The exposure is narrower than the headlines suggest but real. Demands go to the provider, not to the customer, and the customer may not be told. The provider can challenge a demand that conflicts with a qualifying foreign government's law, and comity arguments remain for other conflicts.

Mitigation is architectural and contractual. Encryption keys held by the customer, in its own hardware security modules outside the provider's reach, mean the provider can hand over only ciphertext. Contracts can oblige the provider to redirect requests to the customer and to challenge them where lawful. EU financial firms also weigh the issue under DORA, which requires them, for critical services from a third-country provider, to consider compliance with EU data-protection rules and the effective enforcement of law in that country.

In due diligence on a fintech or AI company, the questions are where the data is, who can decrypt it, which providers are subject to US jurisdiction, and whether what customer contracts promise about data residency survives the Act.

## Example

A German payments company runs its core platform on a US cloud provider's Frankfurt region and holds data on 2 million EU customers. Two bidders' lawyers raise the Act from opposite directions: a US buyer wants to know the platform is portable, and a European buyer fears disclosure. The company shows that customer data is encrypted with keys held in its own hardware security modules in Frankfurt, that its cloud contract obliges the provider to redirect government requests to it and to challenge conflicting ones, and that its DORA register of ICT arrangements records the provider's jurisdiction and the assessment made. It has received no such request in five years. The European bidder had priced a €4m migration to an EU-owned provider into its offer; after the review it drops the migration and holds its price.

## Common mistakes

- Assuming EU data residency removes US legal reach when the provider is a US company.
- Confusing the CLOUD Act with US intelligence surveillance powers, which rest on other laws.
- Letting the provider hold the encryption keys while telling customers their data cannot be disclosed.
- Promising data sovereignty in customer contracts that the cloud contract cannot support.
- Treating the risk as all-or-nothing instead of mapping which data sets sit with US providers.

## Related terms

- [Legal Due Diligence](https://mahouse.world/glossary/legal-due-diligence.md)
- [Due Diligence](https://mahouse.world/glossary/due-diligence.md)
- [SOC 2 Compliance](https://mahouse.world/glossary/soc-2-compliance.md)
- [Hardware Security Module](https://mahouse.world/glossary/hardware-security-module.md)
- [Audit Trail](https://mahouse.world/glossary/audit-trail.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-30. https://mahouse.world/authors/ihor-vlasov