The US CLOUD Act is a 2018 American law that requires US-regulated cloud and communications providers to hand over data in their “possession, custody, or control” when served with valid US legal process, wherever in the world the data is stored. For UK organisations, it means that a UK data centre does not, on its own, put data beyond the reach of US authorities.
What matters is who runs the service and which laws reach that company. This guide explains what the Act says, how it applies to data held in the UK, how it differs from FISA Section 702 and the Patriot Act, and what UK buyers can do about it, including choosing a UK sovereign cloud.
Quick facts
- The law: the Clarifying Lawful Overseas Use of Data (CLOUD) Act, signed on 23 March 2018.
- The key rule: a provider subject to US jurisdiction, served with valid US legal process, must disclose data it possesses, holds or controls “regardless of” whether it is stored inside or outside the US.
- The UK link: a UK-US Data Access Agreement under the Act has been in force since 3 October 2022 and runs to 3 October 2027 unless the two governments extend it.
- Microsoft in France: on 10 June 2025, Microsoft France told a French Senate inquiry, under oath, that it could not guarantee French data would never be passed to US authorities.
- UK policy: on 24 June 2026 the UK government said departments, as data controllers, must assess and reduce the risk themselves.
This article explains the law in general terms and is not legal advice.
What is the US CLOUD Act?
The CLOUD Act is a US federal law that amended the Stored Communications Act, the statute US investigators use to make service providers disclose stored emails, files and records. It does two main things. It confirms that a US order reaches data a provider controls abroad. It also lets the US agree with other countries that each may ask the other’s providers for data directly.
It became law on 23 March 2018 as part of a spending bill, the Consolidated Appropriations Act 2018. The Justice Department publishes the full text of the CLOUD Act, which runs to six sections. The table shows the parts that matter for UK data.
| Part of the Act | Where it sits in US law | What it does | Who it affects |
|---|---|---|---|
| The location rule | 18 U.S.C. § 2713 | Providers must preserve, back up or disclose communications and records “within such provider’s possession, custody, or control, regardless of whether” they are inside or outside the US | Any provider subject to US jurisdiction |
| The challenge route | 18 U.S.C. § 2703(h) | A provider can ask a US court to modify or quash an order for a non-US customer’s communications where disclosure would create a material risk of breaking the laws of a “qualifying foreign government”, a country with a CLOUD Act agreement in force | Providers served with US legal process |
| Executive agreements | 18 U.S.C. § 2523 | The US can make agreements with foreign governments that meet conditions set out in the Act, so each side can serve orders directly on the other’s providers for serious crime | Partner governments and the providers they serve |
The conditions for an agreement are detailed. The US Attorney General, with the agreement of the Secretary of State, must certify to Congress that the partner’s law gives strong protection to privacy and civil liberties.
The agreement can enter into force no earlier than 180 days after Congress is notified, and Congress can block it in that time by enacting a joint resolution of disapproval. Every order the partner government issues under an agreement must relate to serious crime and name a specific person, account, address, device or other identifier. It must also be open to review or oversight by a court, judge, magistrate or other independent authority.
A partner may not use an agreement to intentionally target a US person or anyone located in the US. A US person includes a US citizen or national, a permanent resident and a company incorporated in the US. The terms must not oblige providers to be able to decrypt data, nor stop them from doing so.
What was the Microsoft Ireland case (US v. Microsoft)?
The Microsoft Ireland case was the court fight that led to the CLOUD Act. In December 2013, US investigators obtained a warrant for the emails in one Microsoft account. The emails were stored only in Microsoft’s Dublin data centre. Microsoft refused to hand them over, arguing that the warrant could not reach data held abroad.
Microsoft won in the US Court of Appeals for the Second Circuit on 14 July 2016. The government asked the Supreme Court to review that decision, and the court heard argument on 27 February 2018. The court’s docket shows how far the case reached beyond the US. The UK government, Ireland and the European Commission each filed a brief supporting neither side.
Congress passed the CLOUD Act while the judges were still deciding. On 23 March 2018 the government told the court about the new law. A week later it asked the court to vacate the appeal court’s judgment and send the case back to be dismissed as moot. Under the Act it had obtained a new warrant, which replaced the one in dispute. The Supreme Court declared the case moot on 17 April 2018 and vacated the appeal court’s judgment. It never ruled on whether the original warrant reached Dublin.
Key takeaway: the Microsoft Ireland case did not end with a court deciding that data abroad is reachable. It became moot once the government obtained a new warrant under the new law, so the answer now comes from the statute itself.
Does the CLOUD Act reach data held in the UK?
It can, if the provider holding or controlling the data is subject to US jurisdiction. For the large US-headquartered cloud providers, that is the starting position, whichever region your data sits in.
Two points from the US Department of Justice’s CLOUD Act white paper of April 2019 show where the edges are. First, whether a US company controls data held by its overseas subsidiary is, in the department’s words, “a fact-dependent inquiry”. Second, US jurisdiction “is not limited to U.S. corporations”, but it is not unlimited either: it depends on how much a company does business in, or directs its activity into, the US.
So a UK company with no US parent and no significant US presence is in a very different position from the UK arm of a US group. It is not automatically immune, because the test turns on the facts, but the route for a US order to reach it is much narrower.
The reverse also holds. A provider headquartered outside the US can still be caught if it has operations there. AWS makes this point on its own CLOUD Act page, using the example of a cloud provider based in the EU with US operations.
Key takeaway: under the CLOUD Act, the location of the data is not the deciding factor. Control of the data, and the provider’s exposure to US jurisdiction, are.
How does “possession, custody or control” apply to subsidiaries?
US law looks at who can produce the data, not who owns it. The Justice Department says the law “does not turn on the question of data ‘ownership'”: it can require a provider to disclose data it possesses or controls. For the UK subsidiary of a US group, the question is whether the US parent has enough control over the data its subsidiary holds, which turns on the facts.
The department says this approach is consistent with the Budapest Convention on Cybercrime, and quotes the convention’s explanatory report. There, control covers data outside a person’s physical possession that the person “can nonetheless freely control production of” from within the country making the order. In plain terms, if people or systems in the US can retrieve your data, a US court may treat the US company as controlling it.
No published checklist settles the point. These questions help you judge where your provider stands:
- Who in the group can sign in to the systems that hold your data, and from which countries?
- Does the parent company run the platform, the identity service or the support desk?
- Can the parent instruct the subsidiary to export or hand over customer data?
- Do any sub-processors with US parents hold readable copies, including backups and logs?
The answers are not a legal ruling. They do show whether a practical route exists, and they are the facts a lawyer would ask for first.
How can a provider challenge a CLOUD Act request?
Only the provider can use the Act’s challenge route, and the grounds are narrow. Under section 2703(h), it can move to modify or quash the order within 14 days of service. It must reasonably believe that the customer is not a US person and does not live in the US. It must also believe disclosure would create a material risk of breaking the laws of a “qualifying foreign government”.
The deadline can be extended by agreement with the government or by the court. A qualifying foreign government is one with a CLOUD Act agreement in force with the US whose own laws give providers similar rights to challenge its orders. The UK meets the first condition: its agreement has been in force since 3 October 2022. For orders outside this route, the Act says it does not change the common law standards on whether a court may apply a comity analysis.
The court can change or cancel the order only if it finds three things. Disclosure would cause the provider to break the foreign law. Based on the totality of the circumstances, the interests of justice point that way. And the customer is not a US person and does not live in the US. Weighing the interests of justice is what the Act calls a comity analysis, and it tells the court to take into account, as appropriate:
- the US interest, including the investigators’ need for the data
- the foreign government’s interest in preventing the disclosure
- the penalties the provider or its staff could face for breaking the foreign law
- where the customer is, their nationality and their links to the US
- how far the provider is tied to and present in the US
- how important the data is to the investigation
- whether the data could be obtained another way with less serious consequences
While a challenge is pending, the provider must preserve the data but does not have to hand it over, unless the court finds immediate production necessary.
Two Justice Department policies narrow things before a court is involved. In December 2017 its cybercrime section advised prosecutors to seek an organisation’s data from the organisation itself, rather than its cloud provider, if that will not compromise the investigation. And under section 9-13.525 of the Justice Manual, updated in May 2023, prosecutors “must obtain approval through” the department’s Office of International Affairs before issuing legal process for evidence they have been told is located abroad. No approval is needed where the location is unknown or cannot be pinned to one country, for example where load balancing keeps changing where the data sits.
What you cannot rely on is being told. Under 18 U.S.C. § 2705(b), a US court can order a provider not to tell anyone about a warrant, subpoena or court order for a period the court sets.
Key takeaway: a challenge is possible, but it belongs to the provider, it must be filed within 14 days and it succeeds only if a court agrees. Plan on the basis that a provider may have to comply.
How often do US authorities use the CLOUD Act to reach data abroad?
For business data, rarely, on the providers’ own published figures, but not never. Microsoft and AWS publish figures on government requests. They show only a handful of cases where business customers’ content stored outside the US went to US law enforcement. Individuals’ accounts see more. These figures cover criminal requests. National security orders are reported separately, in ranges, six months after each period ends.
| Provider and period | What the provider reports |
|---|---|
| Microsoft, July to December 2025 | 190 law enforcement requests worldwide for enterprise customer accounts. Customer content disclosed in 45 cases, 31 of them to US law enforcement |
| Microsoft, July to December 2025 | Content provided to US law enforcement for 3 non-US enterprise customers whose data was stored outside the US. One of the 3 was in the EU or EFTA |
| Microsoft, January to June 2025 | Between 500 and 999 orders for content from UK authorities under the UK-US Data Access Agreement |
| AWS, from 2020 to June 2025 | No disclosures of enterprise or government customer content stored outside the US to the US government since it began reporting the figure in 2020 |
For the CLOUD Act, Microsoft’s law enforcement requests report gives the most detail. Microsoft says it always tries to redirect requests for enterprise data to the customer. It also says it gives enterprise customers prior notice of requests unless the law prohibits it. AWS states on its CLOUD Act page that it can only respond to requests where it has the technical ability to do so. It also says most of its services support encryption with customer-managed keys that AWS cannot access.
Consumer accounts, such as Outlook.com, draw more cross-border orders. Of the 5,587 demands for consumer data Microsoft received from US law enforcement in the second half of 2025, 115 were warrants for content stored outside the US. The traffic also runs both ways: UK authorities sent Microsoft between 500 and 999 orders for content under the Data Access Agreement in the first half of 2025.
Key takeaway: the published figures suggest that US disclosures of business data held abroad are rare. Rare is a risk level, not a guarantee, so the decision still rests on how sensitive your data is.
What did Microsoft tell the French Senate?
On 10 June 2025, a French Senate inquiry into public procurement questioned Anton Carniaux, director of public and legal affairs at Microsoft France. Under oath, he was asked whether he could guarantee that French citizens’ data entrusted to Microsoft through the public purchasing body UGAP would never be passed to US authorities, following a US government order, without the explicit agreement of the French authorities.
According to the Senate’s record, he replied “Non, je ne peux pas le garantir” (“No, I cannot guarantee it”), adding that it had never happened so far.
The answer was not an admission of wrongdoing. It reflected the law: a US company can challenge a valid US order, but it cannot promise to refuse one.
What is the UK-US Data Access Agreement?
The UK and the US signed a Data Access Agreement under the CLOUD Act on 3 October 2019, and it came into force on 3 October 2022. It lets investigators in each country ask the other country’s service providers directly for data to counter serious crime.
Before it, a UK police force that needed messages held by a US provider usually had to use mutual legal assistance, a government-to-government process. The UK government’s factsheet on the agreement says that process often takes many months. It also says the agreement creates no new powers: every request must already be lawful under the requesting country’s own law.
| What the agreement says | Article |
|---|---|
| Each country can send orders straight to the other country’s providers, through a designated authority that checks each order first | 5.5 to 5.7 |
| Orders must concern serious crime, meaning offences with a maximum sentence of at least three years | 1.14 and 4.1 |
| Orders may not intentionally target the other country’s people. On the UK side that covers companies located or registered in the UK and anyone located here | 1.12 and 4.3 |
| Each order must name a specific person, account, address, device or other identifier | 4.5 |
| Orders must be open to review or oversight by a court, judge, magistrate or other independent authority | 5.2 |
| A provider that thinks an order falls outside the agreement can object to the issuing country, then to its own government | 5.11 |
| The UK can require its permission before the data is used as evidence in a US death penalty case. The US can do the same for UK use that raises free speech concerns | 8.4 |
| The agreement “does not in any way restrict or eliminate” providers’ duties under the issuing country’s own law | 6.3 |
| It runs for five years from entry into force, to 3 October 2027, unless both sides extend it. Either side can end it on one month’s notice | 17 |
Oversight on the UK side sits with the Investigatory Powers Commissioner’s Office, which the government gave a statutory remit to oversee the UK’s use of the agreement.
The agreement does not switch the CLOUD Act off for UK data. It adds a route for each country’s investigators and limits whom that route can target. A US order under US law to a US provider is a separate matter. When we checked GOV.UK on 19 October 2026, no extension beyond 3 October 2027 had been published.
Does the UK have its own version of the CLOUD Act?
In effect, yes. The Crime (Overseas Production Orders) Act 2019 lets a UK judge order a person or company based or operating outside the UK to produce electronic data. The order must be for an indictable offence or a terrorist investigation. It only works with countries that share a designated co-operation arrangement with the UK, and the Data Access Agreement was designated for that purpose from 28 February 2020.
The Act received Royal Assent on 12 February 2019. Under section 4, the judge must have reasonable grounds to believe that the target has “possession or control” of the data. The judge must also believe the data is likely to be of substantial value and that producing it is in the public interest. Legally privileged material is excluded. So are confidential personal records, such as health records, except in some terrorism cases.
Microsoft’s report says UK warrants it receives under the agreement come under this Act and the Investigatory Powers Act 2016.
Key takeaway: cross-border orders are not a US peculiarity. UK law uses the same “possession or control” idea, so the useful question is which countries’ orders can reach your provider, not whether such orders exist.
How does the CLOUD Act differ from FISA Section 702 and the US PATRIOT Act?
They do different jobs. The CLOUD Act serves criminal investigations: for stored content, a judge must approve a warrant aimed at specific accounts. FISA Section 702 is a foreign intelligence power aimed at non-US persons outside the US, run through written directives to providers rather than individual warrants. The US PATRIOT Act of 2001 is the older counter-terrorism law that many cloud articles still cite.
| US PATRIOT Act | FISA 702 | CLOUD Act | |
|---|---|---|---|
| Became law | 26 October 2001 | 10 July 2008, in the FISA Amendments Act | 23 March 2018 |
| Purpose | To deter and punish terrorism and widen law enforcement’s investigative tools | To collect foreign intelligence on people reasonably believed to be outside the US | To confirm that US criminal legal process reaches data a provider controls abroad, and to allow data-access agreements |
| How data is obtained | Through the existing laws it amended, including wider access to business records under the Foreign Intelligence Surveillance Act (section 215, whose expansion expired on 15 March 2020) | The Attorney General and Director of National Intelligence authorise collection for up to a year, after approval by the Foreign Intelligence Surveillance Court, then issue directives to providers | A warrant from an independent judge for stored content; subpoenas or court orders for other records |
| Who can be targeted | Depends on the power used | Not US persons, and not anyone known to be in the US | The specific person or account named in the order |
| Can the provider challenge? | Depends on the power used | Yes, by petition to the Foreign Intelligence Surveillance Court | Yes, by a motion to modify or quash in limited cases; the Act leaves common law comity standards unchanged |
Section 702’s legal footing changed in 2026. In April 2024, the Reforming Intelligence and Securing America Act extended it for two years. Congress then passed two short extensions. The second, Public Law 119-87 of 30 April 2026, set 12 June 2026 as the date the part of FISA containing Section 702 would be repealed.
When we checked on 19 October 2026, no later law extending it had been enacted. The 2008 Act’s transition rules keep orders, authorisations and directives already in force running until they expire. Check the current position before relying on it either way, because Congress can act at any time.
The US PATRIOT Act, formally the USA PATRIOT Act, was signed on 26 October 2001. MPs still ask about it: a written question answered on 27 March 2026 named it alongside the CLOUD Act. For data held by providers today, US criminal requests run through the Stored Communications Act as the CLOUD Act amended it. National security requests run through other powers, including FISA orders and national security letters, which Microsoft says can seek only basic subscriber details, not content.
Key takeaway: the CLOUD Act is a criminal-law tool with a judge and a named target. Section 702 is an intelligence tool without individual warrants. A sovereignty assessment should consider both.
How do the CLOUD Act, GDPR and UK GDPR fit together?
The CLOUD Act does not change UK data protection law, and both can apply to the same provider at once. That is where the tension comes from. Under UK GDPR, a provider acting as your processor must follow your documented instructions unless UK law requires otherwise, and a US order is not UK law.
The detail sits in Article 28(3)(a) of UK GDPR. A processor may act only on the controller’s documented instructions, “unless required to do so by domestic law”. UK GDPR defines domestic law, in Article 4, as the law of the United Kingdom or a part of it. Congress saw this kind of clash coming: the Act’s findings say foreign law may create “similarly conflicting legal obligations” when US law requires disclosure.
Many articles on the topic quote Article 48 of the GDPR. In the EU text, it says a judgment of a non-EU court, or a decision of a non-EU administrative authority, requiring a transfer or disclosure of personal data can only be recognised or enforced if it is based on an international agreement, such as a mutual legal assistance treaty. The article adds that this is “without prejudice to other grounds for transfer” under the GDPR’s transfer chapter.
UK GDPR no longer contains it: Article 48 was omitted from the UK version on 31 December 2020. It still matters to UK organisations whose processing also falls under the EU GDPR, for example through a branch in the EU.
Transfers are a separate question. The Information Commission (formerly the ICO) says in its guidance on restricted transfers that the contractual location of your provider decides whether you are making a restricted transfer, not where the servers sit. If the provider is located outside the UK, sending it personal data is a restricted transfer, even to UK servers. If that company is in the European Economic Area, UK adequacy regulations cover the transfer. Our guide to international data transfer agreements explains the rest.
Transfers to the US itself have their own route. Since 12 October 2023, UK regulations have treated the US as adequate for transfers to organisations certified under the UK Extension to the EU-US Data Privacy Framework. The government told Parliament on 19 March 2026 that this decision included an assessment of US government access laws, such as the CLOUD Act.
Key takeaway: meeting UK GDPR and being exposed to a US order are separate questions. A US provider can satisfy the first and still face the second, which is why the government asks controllers to assess and reduce the risk.
Data residency vs data sovereignty: what is the difference?
Data residency is where your data is physically stored and processed. Data sovereignty is whose laws can reach it, which depends as much on who owns and controls the provider as on location. A UK data centre gives you data residency in the UK. It does not, by itself, decide which governments can compel access.
| Data residency | Data sovereignty | Data localisation | |
|---|---|---|---|
| The question it answers | Where is the data stored and processed? | Whose laws can reach the data? | Does a rule require the data to stay in one country? |
| What decides it | Region choices, including backups, logs and where support staff work | The provider’s ownership, its links to other countries, its sub-processors and who holds the encryption keys | A specific law, policy or contract term |
| How you check it | Contract terms, region settings and the provider’s list of countries | Companies House, the contracting entity, the sub-processor list and the key management design | The rule itself |
| UK position | Offered by most large providers through UK regions | Varies by provider, so it needs checking | No universal rule that government data classified OFFICIAL must stay in the UK |
For data sovereignty, UK buyers need to look past the region name. A provider can offer data residency, UK data centres and all, while its parent company remains subject to US law.
The NCSC’s cloud security principles ask buyers to understand which legal jurisdictions their data will be subject to, and “whether this is acceptable to you”. The same guidance notes that a jurisdiction being able to request access to data is “normal and not specific to cloud services”.
What has the UK government said?
Three written answers to Parliament in 2026 set out the position:
| Date | What the government said |
|---|---|
| 19 March 2026 | The Department for Science, Innovation and Technology “has not made any central assessments” of the CLOUD Act’s effect on UK government data. It pointed to the UK’s data adequacy decision for the US, which took the CLOUD Act into account |
| 27 March 2026 | The Secretary of State had held no specific talks with Microsoft, AWS or Palantir about the CLOUD Act |
| 24 June 2026 | Departments, as data controllers, must assess and mitigate the risks when providers face overseas legal obligations such as the CLOUD Act, for example through encryption, access controls and contract safeguards |
The government’s cloud guidance says there is no universal requirement for government data classified as OFFICIAL to be held in the UK. It allows OFFICIAL data, including OFFICIAL-SENSITIVE, to be held overseas when legal, data protection and security practices are satisfactory. The CLOUD Act is one of the risks each organisation has to weigh.
Does a UK data centre solve it?
A UK data centre solves the location question. It does not solve the control question. The table shows the difference.
| US cloud provider’s UK region | UK-owned provider in UK data centres | |
|---|---|---|
| Where the data sits | UK | UK |
| Parent company | US | UK (check for any foreign parent) |
| Can a CLOUD Act order reach the data? | Yes, if the US group controls it | Only if the provider, or a sub-processor holding the data, is subject to US jurisdiction, which depends on its US presence |
| Who you contract with | Often a European company in the US group | A UK company (check) |
| Who can access it for support | Depends on the provider’s global support model | Depends on the provider (ask) |
| Typical mitigation | Encryption with keys you control, contract terms, access controls | Confirm ownership, support location and sub-processors |
Key takeaway: residency is where the data is. Sovereignty is whose law can reach it. A UK region answers the first question, not the second.
What can UK organisations do?
Start with the data, not the provider. Decide which data would cause real harm if a foreign authority obtained it, then check who can reach that data and close the routes you can. The steps below work in order, and each one leaves a written record you can show a client or an auditor.
- Classify your data. Not all data carries the same risk. Focus on client confidential, personal and public sector data, and on anything covered by legal privilege.
- Find out who owns the provider. Search for it on the free Companies House register, which the Companies House search guidance explains. Read its list of people with significant control: usually anyone holding more than 25% of the shares or votes, able to appoint or remove most of the directors, or otherwise able to influence or control the company. Where the list names a company rather than a person, look that company up too.
- Check the contracting entity and the support model. Ask which company you contract with, where it is established and which countries the service is supported from. The NCSC says a provider should list every country where your data is stored, processed and managed, and commit to tell you when that list changes.
- List the sub-processors. A UK-owned provider that backs up to a US-owned cloud brings US law back in through the backup. Ask for the full list, including backup, monitoring and email services.
- Control the keys. Encryption with keys you generate and hold outside the provider’s systems limits what any order can produce. The Justice Department says the CLOUD Act creates no new power to force providers to decrypt. Check the limits too: a service that must read your data to work may need the keys, and account details and logs often stay readable.
- Use the contract. Ask the provider to commit to challenging orders it believes are unlawful, to redirecting authorities to you and to disclosing only the minimum. Ask it to tell you about any request where the law allows, remembering that a US court can bar it from doing so.
- Put the most sensitive data with a UK-owned provider. Where a foreign order would be unacceptable, choose a provider with no US parent, little US presence and UK-based support and sub-processors. That narrows the routes for a US order, although no provider can rule one out entirely.
- Write the assessment down. Record the risk, the measures and your decision alongside your data protection impact assessment. Review it when the provider’s ownership changes, or when the Data Access Agreement or Section 702 position moves.
- Plan the exit. If the assessment says some workloads should move, our guide to cloud repatriation sets out how to plan a move off AWS or Azure.
What does CLOUD Act exposure look like in practice?
It depends on the chain of control around your data. The five scenarios below are simplified examples, not legal assessments. Each shows whether a US order has a route to the data, what narrows that route and what to check. Use them to structure your own review, then take advice on the facts of your case.
| Scenario | Can a US order reach the data? | What narrows the route | What to check |
|---|---|---|---|
| A UK law firm uses Microsoft 365 with data held in UK data centres | Yes. Microsoft is a US company, and the location rule covers data it controls in the UK | Microsoft’s stated policy of redirecting enterprise requests to the customer; DOJ guidance to seek enterprise data from the enterprise; encryption where the service supports keys you hold | The contracting entity, the notice terms, which data is covered by customer-held keys |
| A council keeps case files with a UK-owned provider whose backups go to a US-owned public cloud | Possibly, through the backup provider, if it can produce readable copies | Encrypting backups before they leave, with keys the backup provider never holds; or a UK-owned backup target | The sub-processor list and where the backup keys live |
| A UK software company with a US sales subsidiary hosts client data on its own UK servers | Possibly. Its US activity may bring the company itself within US jurisdiction | Keeping US staff and systems away from client data, so control sits in the UK | Who in the group can access the data; take legal advice on the facts |
| A research team uses a US provider’s London region, with keys held in its own hardware outside the provider | The provider can be ordered to produce data, but can only produce what it can read | The provider never holding the keys; the Act creates no power to force decryption | Data the service decrypts to process it, plus metadata and account records |
| A UK-owned provider with UK-only staff, support and sub-processors and no US presence | Through the provider, only if a US court found it subject to US jurisdiction, which is narrow on these facts | The Data Access Agreement cannot be used to target companies registered in the UK or people located here | That the facts stay true: ownership, customers, staff and sub-processors |
Two patterns stand out. Encryption narrows exposure most when the provider never holds the keys. Ownership narrows it most when the whole chain, including backups and support, sits outside US control. Even then, UK authorities can still seek data under UK law, and Microsoft’s report notes that mutual legal assistance remains available for US requests that the agreement does not cover.
How BlackBox Hosting can help
BlackBox Hosting Limited is a UK company, registered in England, and runs managed private and sovereign cloud in UK data centres. Our sovereign cloud serves organisations in government and the public sector, healthcare and research, finance and insurance, legal and professional services, and defence and manufacturing.
Our white paper on cloud sovereignty looks at the legal and jurisdictional side of sovereignty, including the CLOUD Act. If you are assessing CLOUD Act risk for your own data, talk to an expert.
Frequently asked questions
The Clarifying Lawful Overseas Use of Data Act is a US law, signed on 23 March 2018. It confirms that providers subject to US jurisdiction must disclose data in their possession, custody or control in response to valid US legal process, wherever the data is stored. It also lets the US make data-access agreements with other countries.
It can. If the provider that holds or controls the data is subject to US jurisdiction, a valid US order can reach data stored in the UK. Storing data in a UK data centre does not change that on its own.
Not simply because they are UK companies. The US Department of Justice says jurisdiction depends on a company’s contacts with the US, and control of a subsidiary’s data is fact-dependent. A UK company with no US parent and little US presence is much less exposed.
No. The USA PATRIOT Act of 2001 expanded US surveillance and investigative powers. The CLOUD Act of 2018 confirms that US legal process reaches data a provider controls wherever it is stored, and lets the US make data-access agreements with other countries. Section 702 of FISA, an intelligence power, is the other law usually discussed.
It can limit what an order produces. The US Justice Department says the CLOUD Act creates no new power to force providers to decrypt data. If only you hold the keys, the provider can hand over only encrypted data. Data the service must read in clear, and account records, may still be exposed.
Microsoft is a US company, so a valid US order can reach Microsoft 365 data it controls, including data held in UK data centres. Microsoft says it always tries to redirect requests for enterprise data to the customer. Its report for July to December 2025 lists content disclosures to US law enforcement for three non-US enterprise customers with data stored outside the US.
Often, but not always. Microsoft, for example, says it notifies enterprise customers unless the law prohibits it. A US court can order a provider not to tell anyone about a warrant or order. Ask your provider to commit to notice wherever the law allows, and to tell you once any non-disclosure order expires.
No. The UK government’s position is that organisations, as data controllers, must assess the risk and put proportionate safeguards in place. For the most sensitive data, some choose a UK-owned provider.