US CLOUD Act
In shortUS providers must hand over data even when it sits in Frankfurt.
The Clarifying Lawful Overseas Use of Data Act passed in 2018. It settled a dispute Microsoft had carried for years, all the way to the Supreme Court: must a US corporation hand over emails stored on a server in Ireland?
The legislature's answer was yes. What matters is not where the data sits, but whether the company has control over it.
What it actually covers
The CLOUD Act reaches any provider of electronic communication or remote computing services subject to US jurisdiction. That includes American corporations and their subsidiaries — the German GmbH of a US company too, where the parent exercises actual control.
The order is served on the company, not on the data centre. A server location in the EU does not change that. A European operating contract only changes it where the US parent neither owns nor holds nor controls the data — and that is precisely where sovereign cloud offers differ from each other. See Sovereign cloud.
The conflict with the GDPR
Article 48 GDPR says, in substance: a judgment or an authority's order from a third country is a valid basis for a transfer only where a mutual legal assistance treaty carries it. The CLOUD Act provides for no such process.
A US provider with European customers therefore stands between two legal orders that contradict each other. Both attach painful penalties. In practice, the legal order where the management sits usually wins.
What this means for a decision
It does not mean American providers hand data over freely. There are procedures, reviews and transparency reports. It means the risk is not yours to control, and you may never learn that it materialised.
For most companies that is bearable. For processing health data, defence projects, negotiation files and engineering drawings, it frequently is not. The difference is not technical. It is the question of what a single access would cost you.