CLOUD Act Data Access
The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).
Summary
The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).
This is one of the "three data gravity wells" (US/EU/China) that shape modern multi-region S3 architecture. With **China Data Localization** as the PRC-side counterpart and **Data Residency** as the architectural framing, CLOUD Act is what makes "AWS in eu-central-1" categorically different from "EU-headquartered provider" for some regulators and customers.
- "The bucket is in Frankfurt" does not make the data shielded from CLOUD Act compelled disclosure if the operating cloud provider is US-headquartered.
- Sovereign cloud and "EU Data Boundary" offerings address the jurisdictional gap, not the technical gap. The technical access path may be identical; the legal access path is what changes.
- CLOUD Act has been used in practice — it is not a hypothetical risk to wave away.
scoped_toSovereign Storage — the architectural response- Drives demand for Aliyun OSS / Tencent COS / Huawei OBS as in-PRC alternatives for non-US-domiciled data
scoped_toS3, Object Storage
Definition
The exposure created by the **Clarifying Lawful Overseas Use of Data Act (2018, US)**, which authorizes US law-enforcement to compel US-headquartered cloud providers (AWS, Microsoft, Google, Cloudflare, Wasabi, Backblaze) to disclose customer data **regardless of where the data is physically stored**. Together with **GDPR's Article 48** (which prohibits transfers compelled by foreign court orders without an MLAT), this creates a structural conflict-of-laws for any S3 bucket holding EU, UK, or PRC-domiciled personal data on a US-headquartered provider — even when that bucket lives in an EU region.
Connections 3
Outbound 3
scoped_to3Resources 3
The CLOUD Act statute itself — primary source for the compelled-disclosure scope including Section 103 on "data stored abroad."
Reference overview of the CLOUD Act including the Microsoft v. United States precedent that motivated it and the executive-agreement framework.
EU Commission's data-protection portal covering GDPR Article 48 (foreign-court-compelled transfers) — the conflict-of-laws axis with CLOUD Act.