The Cloud Act (Clarifying Lawful Overseas Use of Data Act) is a US law passed in 2018 that allows US authorities to require a provider subject to US law to give access to data it controls, including when that data is stored outside the United States.
The criterion is therefore not where the server is, but the nationality or legal ties of the company operating the service. Hosting data in a datacenter located in France with a US provider is not enough to put it beyond the reach of this law. The text provides for ways to challenge requests and for bilateral agreements between states.
The Cloud Act is at the heart of the European debate on digital sovereignty. It is often compared with the GDPR and led to the addition, in the SecNumCloud framework, of criteria for immunity from non-European law.
Why it matters when hiring
The topic belongs mostly to procurement, legal and security, but it drives technical choices that affect hiring. An organization leaving a hyperscaler for a sovereign cloud will need engineers comfortable outside the AWS, Azure or Google Cloud ecosystem. A CISO or architect who can explain the Cloud Act without caricature shows a good grasp of the stakes.