Clarifying Lawful Overseas Use of Data Act

Overview

The Clarifying Lawful Overseas Use of Data Act, the CLOUD Act, is a US federal law enacted in 2018. It amended the Stored Communications Act to clarify that US-based electronic communication and remote computing service providers must produce data within their possession, custody, or control in response to lawful US legal process, regardless of whether the data is stored inside or outside the United States.

The law arose from the Microsoft Ireland case, in which the question was whether US warrants could reach data stored abroad. The CLOUD Act also created a mechanism for the United States to enter into executive agreements with trusted foreign governments to streamline cross-border access to data for serious crime investigations.

Who It Applies To

The Act applies to providers subject to US jurisdiction, including major cloud, communications, and software companies, even when their customers' data resides overseas. It is highly relevant to multinational organizations and to non-US customers of US-headquartered providers, because their data may be subject to US legal process. Foreign governments party to a CLOUD Act agreement can also direct certain demands to covered providers.

Key Requirements

Covered providers must respond to lawful US legal process for data they control, wherever stored. The Act allows providers to challenge or seek to quash legal process where complying would create a material risk of violating the laws of a qualifying foreign government, through a comity analysis. Executive agreements set conditions, safeguards, and oversight for reciprocal cross-border data requests, and exclude targeting of the other country's persons.

Penalties for Non-Compliance

Failure to comply with valid US legal process can result in contempt of court and associated sanctions. The Act itself does not impose a separate penalty schedule; consequences flow from existing legal-process enforcement mechanisms.

How to Comply

Providers should establish processes to evaluate and respond to legal demands, including conflict-of-law and comity assessments, and maintain data-location and control mapping. Organizations whose data may be subject to the Act should account for it in data-residency, encryption, and contractual strategies, and consider how it interacts with GDPR and other transfer rules when choosing providers and architectures.