CLOUD Act Data Access
The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).
Summary
The exposure created by the US Clarifying Lawful Overseas Use of Data Act (2018), which authorizes US law enforcement to compel US-headquartered cloud providers to disclose customer data **regardless of physical storage location** — combined with GDPR Article 48 (which prohibits foreign-court-compelled transfers without an MLAT).
This is one of the "three data gravity wells" (US/EU/China) that shape modern multi-region S3 architecture. With **China Data Localization** as the PRC-side counterpart and **Data Residency** as the architectural framing, CLOUD Act is what makes "AWS in eu-central-1" categorically different from "EU-headquartered provider" for some regulators and customers.
- "The bucket is in Frankfurt" does not make the data shielded from CLOUD Act compelled disclosure if the operating cloud provider is US-headquartered.
- Sovereign cloud and "EU Data Boundary" offerings address the jurisdictional gap, not the technical gap. The technical access path may be identical; the legal access path is what changes.
- CLOUD Act has been used in practice — it is not a hypothetical risk to wave away.
scoped_toSovereign Storage — the architectural response- Drives demand for Aliyun OSS / Tencent COS / Huawei OBS as in-PRC alternatives for non-US-domiciled data
scoped_toS3, Object Storage
Definition
The exposure created by the Clarifying Lawful Overseas Use of Data Act (2018, US), which authorizes US law-enforcement to compel US-headquartered cloud providers (AWS, Microsoft, Google, Cloudflare, Wasabi, Backblaze) to disclose customer data regardless of where the data is physically stored. Together with GDPR's Article 48 (which prohibits transfers compelled by foreign court orders without an MLAT), this creates a structural conflict-of-laws for any S3 bucket holding EU, UK, or PRC-domiciled personal data on a US-headquartered provider — even when that bucket lives in an EU region.
Connections8
Outbound3
scoped_to3Resources3
The CLOUD Act statute itself — primary source for the compelled-disclosure scope including Section 103 on "data stored abroad."
Reference overview of the CLOUD Act including the Microsoft v. United States precedent that motivated it and the executive-agreement framework.
EU Commission's data-protection portal covering GDPR Article 48 (foreign-court-compelled transfers) — the conflict-of-laws axis with CLOUD Act.