IT Glossary
The CLOUD Act is a US law letting US authorities require providers to disclose data they control, even if stored in the EU. What it means for SaaS buyers.
November 2, 2026
The CLOUD Act is a United States law that lets US authorities, with a warrant, require providers under US jurisdiction to disclose data in their possession, custody or control, wherever that data is stored. The Clarifying Lawful Overseas Use of Data Act was enacted in March 2018 and follows the provider and its owners, not the location of the data center.
Not on its own. Data residency answers where the data sits; the CLOUD Act asks who controls the company that holds it. An EU region operated by a US provider, or a European SaaS vendor running on a US cloud provider, can keep a link to US jurisdiction that residency alone does not cut.
The tension is written into European law. GDPR Article 48 states that a judgment or decision of a third-country authority requiring the transfer or disclosure of personal data is only recognized or enforceable if based on an international agreement, such as a mutual legal assistance treaty. The CLOUD Act itself, enacted in March 2018, is documented by the US Department of Justice. Which obligation prevails in a given case is a question for legal counsel.
A 300-person fintech runs 120 SaaS applications. A banking client asks its data protection officer to list every vendor that could receive a US disclosure order. The IT team knows the CRM and the office suite, but not which smaller tools are US-owned, which European tools run on a US cloud, or which sub-processors each contract names.
Answering needs four facts per vendor: control, hosting, sub-processors and the policy on government requests. Corma provides the starting point, a complete inventory of the SaaS applications in use with their contracts and renewals, including shadow IT, so the review covers every vendor and not only the known ones. Corma itself is hosted in the EU, ISO/IEC 27001:2022 certified and GDPR compliant, and buyers can put the same four questions to it, starting from its security page.
It can. The CLOUD Act targets data in a provider's possession, custody or control wherever it is stored, so the provider's jurisdiction decides, not the server's location.
The two can conflict. GDPR Article 48 recognizes a third-country order to disclose personal data only if it rests on an international agreement, so a provider can face competing obligations. How that conflict is resolved in a given case is a matter for legal counsel.
The United States enacted the CLOUD Act in March 2018. The name stands for Clarifying Lawful Overseas Use of Data.
Ask who controls the company, who hosts the data and where, which sub-processors are involved, and what the policy on government requests is. Keep the answers with the contract and check them again at renewal.
