What is the Cloud Act?

It is a 2018 American law that allows U.S. authorities to require a provider subject to their jurisdiction to disclose data it holds or controls, including when that data is hosted outside U.S. territory.

My data is hosted in Europe: am I protected from the Cloud Act?

Not necessarily. If the service provider or its parent company is subject to American law, the Cloud Act can apply even if the data is physically located in Europe. It is the company's jurisdiction, as much as its location, that matters.

Are the Cloud Act and GDPR compatible?

They often create tension. Disclosing personal data to a foreign authority without a European legal basis can violate GDPR, placing a service provider subject to both laws in a legally uncomfortable position.

Does the Data Privacy Framework solve the problem?

It provides a framework for EU–U.S. transfers, but remains fragile: the two mechanisms that preceded it were invalidated by European courts. Basing your entire compliance on this sole framework exposes you to risk if it is challenged again.

How can I reduce this risk for my electronic signatures?

By choosing a service provider whose hosting and jurisdiction are European, such as Certyneo, your documents, personal data, and evidence remain under European law, beyond the direct reach of the Cloud Act and FISA 702.

Compliance

GDPR versus Cloud Act: the risks of an American service provider

GDPR protects the personal data of Europeans; the American Cloud Act allows U.S. authorities to require a service provider subject to their law to disclose data, wherever it is stored. Two legal systems clash, and your choice of signature service provider determines which side the balance tips.

Updated on July 31, 2026

Legal framework

The opposition is not theoretical: it arises from two legal systems that each claim scope over the same data. Understanding these texts makes it possible to assess the actual exposure of a service provider, beyond the sole question of hosting.

To move from theory to practice, discover the Certyneo electronic signature solution and its offer dedicated to your sector — eIDAS compliant, no installation required.

GDPR: it strictly regulates the processing of personal data and only authorizes their transfer outside the Union under certain conditions. Communicating data to a foreign authority without a European legal basis may constitute a violation.
Cloud Act (2018): this U.S. law allows U.S. authorities to compel a provider subject to their jurisdiction to disclose data it holds or controls, including when hosted outside U.S. territory.
FISA 702: this basis for U.S. intelligence authorizes surveillance of communications of non-U.S. persons with providers subject to U.S. law, fueling distrust about the real protection of transferred data.
Data Privacy Framework: this framework governing EU–U.S. transfers aims to offer guarantees, but remains legally fragile — the two mechanisms that preceded it (Safe Harbor, Privacy Shield) were struck down by European courts, which calls for caution.

Guarantees to verify with a provider

Company jurisdiction: the entity operating the service and its parent company are subject to the law of an EU Member State, beyond the reach of the Cloud Act and FISA 702.

European hosting: documents, personal data, and audit logs are stored in the EU, with no replication to the United States or any other third country.

Controlled subcontractors: hosting providers and technical service providers do not reintroduce dependence on an actor subject to U.S. law.

No default transfer: no data transfer outside the EU takes place systematically; if it does exist, it relies on a documented legal basis, not on the Data Privacy Framework alone.

Data access policy: the provider clarifies how it would handle a foreign authority request and what guarantees protect your data.

Verifiable evidence: the location of processing and the subcontracting chain are documented and enforceable, not merely stated in marketing materials.

Choose a sovereign solution

1
Identify exposure to foreign law
For each tool that processes your signatures, determine whether the provider, its parent company, or its subcontractors are subject to a jurisdiction with extraterritorial reach, such as U.S. law.
2
Verify hosting and data flows
Confirm that data remains in the EU and that no systematic transfer to a third country takes place, particularly to the United States.
3
Assess the legal bases for transfer
If a transfer exists, examine what it is based on and keep in mind the historical fragility of EU–U.S. frameworks before relying on them.
4
Favor a European alternative
All else being equal, choose a provider whose hosting and jurisdiction are European, to place your data beyond the reach of the Cloud Act and FISA 702.

Frequently asked questions

What is the Cloud Act?: It is a 2018 American law that allows U.S. authorities to require a provider subject to their jurisdiction to disclose data it holds or controls, including when that data is hosted outside U.S. territory.
My data is hosted in Europe: am I protected from the Cloud Act?: Not necessarily. If the service provider or its parent company is subject to American law, the Cloud Act can apply even if the data is physically located in Europe. It is the company's jurisdiction, as much as its location, that matters.
Are the Cloud Act and GDPR compatible?: They often create tension. Disclosing personal data to a foreign authority without a European legal basis can violate GDPR, placing a service provider subject to both laws in a legally uncomfortable position.
Does the Data Privacy Framework solve the problem?: It provides a framework for EU–U.S. transfers, but remains fragile: the two mechanisms that preceded it were invalidated by European courts. Basing your entire compliance on this sole framework exposes you to risk if it is challenged again.
How can I reduce this risk for my electronic signatures?: By choosing a service provider whose hosting and jurisdiction are European, such as Certyneo, your documents, personal data, and evidence remain under European law, beyond the direct reach of the Cloud Act and FISA 702.

→ Electronic signature guide · → Security & compliance · → Understanding the eIDAS regulation · → The figures of digital sovereignty

Keep your data under European law

With an electronic signature hosted in the Union and operated in Europe, place your documents beyond the reach of extraterritorial legislation.

Certyneo Community

A question about electronic signatures?

Join the Certyneo community: ask your questions, share your answers and connect with thousands of users and our team.