When European jurisdiction is not enough

The relationship with European law

The General Data Protection Regulation (GDPR) governs how personal data of EU residents must be handled, stored, and transferred—and places strict limits on transfers to third countries without adequate protection. The CLOUD Act operates within a different legal framework. When a US authority requests data from a provider subject to US jurisdiction, the European customer may have limited practical options.

This places globally operating providers in a complex position. A company subject to both European and US legal obligations may face competing requirements when responding to government access requests. The CLOUD Act includes mechanisms that allow providers to challenge requests that may conflict with foreign law, but these are limited in scope. The broader legal questions remain an active topic of debate among European data protection authorities and policymakers. It is one reason why data sovereignty has become an increasingly important consideration in procurement decisions across both the public and private sectors in Europe.

A related instrument, the Foreign Intelligence Surveillance Act, FISA, addresses a different dimension of the same question. Where the CLOUD Act operates through law enforcement with some judicial oversight, FISA operates through intelligence collection, with different procedural conditions. Together, these instruments illustrate why the question of where a provider is headquartered has become relevant alongside the question of where its servers are located.

What this means for procurement

For organizations handling sensitive information, selecting a provider involves more than evaluating functionality, performance, and security controls.

Procurement teams increasingly consider whether the provider itself is subject to legal obligations that could affect how customer data is handled, disclosed, or accessed. A solution may be hosted within Europe and still be connected to legal frameworks outside Europe through ownership structures, corporate relationships, or operational control.

Whether that exposure is acceptable depends on the nature of the information involved, the organization’s risk profile, and its regulatory obligations. For a growing number of organizations, questions of jurisdiction and sovereignty have become part of the security assessment.

The question is not only whether a solution is secure. It is whether the organization operating it is subject to legal obligations that could affect the confidentiality, control, or governance of the data entrusted to it.