The CLOUD Act reaches data by custody, not by location. European sovereignty claims are mostly about location.
Article 48 of the GDPR says a foreign court's order is not, on its own, enforceable here. It does not say the company may not comply, and most of this market sits in that gap.
Draft, not yet edited. Written by Iris Valdés, and not yet through the desk: nothing here has been checked against the sources listed at the foot of the page. Do not act on it.
The American provision that matters here is about sixty words long. The load-bearing ones are possession, custody, or control, and the phrase that makes it irrelevant whether the material sits within or outside the United States. A provider subject to US jurisdiction produces what it can reach.
Article 48 of the GDPR is one sentence. A judgment or an administrative decision of a third country requiring a controller or processor to hand over personal data may be recognised or enforced here only if it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty.
Both of those are accurate. They bind the same company, about the same records, on the same afternoon.
Neither is new. One is from 2018, the other from 2016, and nothing in the past year has altered either. What has grown in the meantime is the volume of product sold to sit between them.
Four questions, and a data centre answers one of them
Where does the data sit. Who can log in. Which court can compel the company. Who owns the company.Sovereign is asked to carry all four at once in most of this material, which is why it can be used honestly by people who mean entirely different things. Ask which one is meant and the conversation improves immediately. Four questions with four separate answers. A claim that answers the first and implies the rest is not usually a lie. It is an accurate answer to the question it was asked.
The first is a configuration setting. It is verifiable, it is contractually warrantable, and it is the one the industry has spent a decade learning to answer well. Regions are real. They are just not jurisdiction.
The second is a rota and a key. Sovereign tiers answer it with EU-resident operations staff and customer-held keys, both genuine improvements. The limit is structural: a service that only stores your data can be kept from reading it, and a service that computes on your data holds plaintext somewhere for as long as it computes. Confidential computing narrows that window. It does not remove the operator, and the question was never whether the operator was well behaved.
The third follows the company, not the rack. A court asked to compel disclosure does not ask where the disk is. It asks whether the entity in front of it has custody or control of what is on the disk.
The fourth is who that entity is, and it is the only one of the four that a datasheet structurally cannot answer, because it is not a fact about the service.
Control is a question of fact, decided by the court that issued the order, under the law of the country that issued it.
A European operating company, a European legal entity holding the customer contract, European staff, European premises — all of that can be true while the question a US judge is actually asking remains open. That question is not about nationality. It is about whether some entity within reach can, in practice, obtain the material. A licensing relationship, a support escalation path, a shared identity plane, an agreement that lets one party keep the other's platform current — ordinary commercial arrangements, all of them potentially relevant, none of them in a datasheet, because none of them is a feature.
What it costs is a fortnight and an awkward call
The four answers are usually held by four different functions. Procurement has the datasheet. Legal has the data processing agreement. Security has the access model and the key custody design. Nobody has the ownership chain, because until recently nobody had a reason to ask for it.
Assembling them takes a fortnight and one uncomfortable conversation with an account manager who does not have the fourth answer either. He is not concealing it. It is held above him, it changes without his involvement, and the material he was given answers the first two questions because those are the two his employer can warrant.
The premium on a sovereign tier is charged against the first two answers. Those were not the exposed ones.
Article 48 is a signpost, not a shield
This is the part most summaries get backwards, and it is worth being slow about.
Article 48 does not prohibit disclosure. It denies the foreign order recognition and enforceability here, and then closes with a clause preserving other grounds for transfer under Chapter V. That clause points at the derogations in Article 49, and the one everybody reaches for is important reasons of public interest — which Article 49(4) requires to be recognised in Union or Member State law. A foreign prosecutor's interest in a foreign prosecution is not.
So the processor's Friday afternoon looks like this. An order it is directed to obey. An article confirming that the order is not enforceable in Europe. No derogation that plainly fits. What it does not have anywhere in either instrument is an instruction. What it has is a choice between two exposures, and a legal department selecting the smaller one on facts it will not be able to discuss afterwards.
Nobody has answered this in a way that survives a follow-up question. There is a comity mechanism on the American side: a provider may move to quash where the target is a non-US person outside the United States and disclosure would risk breaching the law of a government holding an executive agreement. Whether that gateway is open for data held in the EU this month, we could not establish from this desk.
The notice clause and the reason it has an exception
Enterprise contracts promise to notify the customer of a government access request unless legally prohibited from doing so. The prohibition is provided for in the same body of law that produces the order: a court may direct the provider not to tell you.Which means the clause performs best in exactly the cases where it matters least.
Transparency reports count requests by category and half-year. A count cannot tell you whether one of them was yours, and it is not built to.
The first time any of this is tested in a form a customer can read, it will not be a judgment. It will be a subprocessor notice — a line in a change list, the contractual notice period, a new entity name in a new place, posted to a page nobody in your organisation is subscribed to. The datasheet will not change. It describes a building.
Written from
Primary The document itself. Claims in this piece rest only on these.
- 18 U.S.C. § 2713, as inserted by the CLOUD Act (Pub. L. 115-141, Div. V)The provision the first half of this piece rests on. We have quoted only the two operative phrases — 'possession, custody, or control' and the words placing data within or outside the United States beyond reach of the distinction. An editor should read the section off the current code before this runs; the paraphrase is intended to be repeatable without the text alongside it, which is the standard it must meet.
- Regulation (EU) 2016/679 (GDPR), Article 48, and Article 49(1)(d) with Article 49(4)Article 48 is one sentence and the argument turns on its closing clause preserving other Chapter V grounds. Article 49(4) is the provision that stops a third country's own public interest from qualifying. Both should be read off the consolidated text by the desk; if the closing clause of Article 48 is characterised wrongly here, the middle of the piece does not stand.
- Placeholder: 18 U.S.C. § 2705(b), non-disclosure ordersUsed for the claim that a court may direct a provider not to tell the customer. We are confident this is the effect of the section and have not stated a duration or a standard, because we have not verified the current text or the successive policy limits placed on its use. Verify before publication.
- Placeholder: 18 U.S.C. § 2703(h) and § 2523, comity motions and qualifying foreign governmentsThe comity mechanism and the executive-agreement gateway. The piece states that the gateway exists and declines to say who is through it. We could not establish from this desk the status of any EU-US agreement as at September 2026, and the piece says so rather than assuming. Do not let an editor tighten that sentence into a claim.
- Placeholder: EDPB Guidelines 2/2018 on derogations under Article 49Supports the reading that a third country's prosecutorial interest is not an important reason of public interest recognised in Union or Member State law. Cited here as guidance, not as law. Check the paragraph number before anyone prints one.
Reporting Attributed, not relied on. Where the reporting is the fact, it says so.
- Placeholder: Brussels reporting on the EU-US e-evidence negotiationsAttributed if used. No claim in this piece rests on it, and the piece deliberately does not report a negotiating status.
Lead Pointed us at the story. Nothing here is cited as authority.
- Placeholder: vendor launch material for sovereign cloud tiersPointed us at the shape of the claim being made. Not cited, not relied on, and no company is named anywhere in this piece. Nothing here should be edited into a statement about any identified vendor's ownership, structure or contract terms without documents in hand.