Originally published on moveinfra.eu .

The US Clarifying Lawful Overseas Use of Data (CLOUD) Act is a 2018 American law that requires US-based technology providers to hand over customer data when served with a valid US warrant or subpoena, regardless of whether that data is stored in the United States, Frankfurt, or Dublin. Because the law applies to any company under US jurisdiction and any subsidiaries it controls, choosing an EU data region on AWS, Google Cloud, or Microsoft Azure does not exempt your infrastructure from its reach. For European founders, this creates a direct legal conflict with Article 48 of the EU's General Data Protection Regulation (GDPR), which forbids transferring data to non-EU authorities outside of recognized international treaties.

Key takeaways

Jurisdiction beats geography: The US CLOUD Act applies to the parent company's legal headquarters and control structure, not the physical location of the server holding your data.

EU regions do not block US warrants: Contracting with…