Pain Point

CLOUD Act Data Access

The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).

3 connections 3 resources 2 posts

Summary

What it is

The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).

Where it fits

This is one of the "three data gravity wells" (US/EU/China) that shape modern multi-region S3 architecture. With **China Data Localization** as the PRC-side counterpart and **Data Residency** as the architectural framing, CLOUD Act is what makes "AWS in eu-central-1" categorically different from "EU-headquartered provider" for some regulators and customers.

Misconceptions / Traps
  • "The bucket is in Frankfurt" does not make the data shielded from CLOUD Act compelled disclosure if the operating cloud provider is US-headquartered.
  • Sovereign cloud and "EU Data Boundary" offerings address the jurisdictional gap, not the technical gap. The technical access path may be identical; the legal access path is what changes.
  • CLOUD Act has been used in practice — it is not a hypothetical risk to wave away.
Key Connections
  • scoped_to Sovereign Storage — the architectural response
  • Drives demand for Aliyun OSS / Tencent COS / Huawei OBS as in-PRC alternatives for non-US-domiciled data
  • scoped_to S3, Object Storage

Definition

What it is

The exposure created by the **Clarifying Lawful Overseas Use of Data Act (2018, US)**, which authorizes US law-enforcement to compel US-headquartered cloud providers (AWS, Microsoft, Google, Cloudflare, Wasabi, Backblaze) to disclose customer data **regardless of where the data is physically stored**. Together with **GDPR's Article 48** (which prohibits transfers compelled by foreign court orders without an MLAT), this creates a structural conflict-of-laws for any S3 bucket holding EU, UK, or PRC-domiciled personal data on a US-headquartered provider — even when that bucket lives in an EU region.

Connections 3

Outbound 3

Resources 3

Featured in