{"id":3288,"date":"2026-10-05T22:26:31","date_gmt":"2026-10-05T20:26:31","guid":{"rendered":"https:\/\/eu.klytic.com\/?page_id=3288"},"modified":"2026-10-06T17:21:29","modified_gmt":"2026-10-06T15:21:29","slug":"protect-business-cloud-act","status":"publish","type":"page","link":"https:\/\/eu.klytic.com\/en\/protect-business-cloud-act\/","title":{"rendered":"How can a business protect itself from the CLOUD Act?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3288\" class=\"elementor elementor-3288 elementor-3213\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5012410 e-con-full kly-g e-flex e-con e-parent\" data-id=\"5012410\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-6bf4b10 e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"6bf4b10\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-27ce0a3 e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"27ce0a3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-cbd86bb elementor-widget elementor-widget-text-editor\" data-id=\"cbd86bb\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/#souverainete\">Sovereignty<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#38bdf8\">Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73d31a5 elementor-widget elementor-widget-heading\" data-id=\"73d31a5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">How can a business protect itself from the CLOUD Act?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-74402bd elementor-widget elementor-widget-text-editor\" data-id=\"74402bd\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">A business protects itself from the CLOUD Act by choosing who holds its data, not merely by moving its servers. The 2018 US law allows a US authority, in the course of a proceeding, to require a provider subject to US jurisdiction to produce the data that provider holds or controls, including when that data is stored outside the United States. It does not create automatic access to European datacenters.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5eaee0 elementor-widget elementor-widget-text-editor\" data-id=\"c5eaee0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>11 min<\/b> read<\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-343633b e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"343633b\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-d60970b e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"d60970b\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4ce389a elementor-widget elementor-widget-text-editor\" data-id=\"4ce389a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What the law does, and what it does not do<\/h2><p>The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) amends US law on stored communications. Three limits help avoid misreadings.<\/p><ul><li>It targets a provider subject to US law. A French company that operates its own servers is not, on that basis alone, the recipient of a US order.<\/li><li>It presupposes a proceeding. It is not a permanent copy of European email services sent to a US administration.<\/li><li>It does not disappear because the disk is in Amsterdam, Dublin or Paris, as long as the US provider has possession or control of the data.<\/li><\/ul><p>The real risk is therefore narrower than is often claimed, and more lasting: a targeted request, addressed to the provider, in the course of a proceeding.<\/p><p>The law also provides for agreements between governments to govern certain cross-border requests. This aspect does not change the purchasing question: who, in your chain, is a US provider with control of the data?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-727ffcd elementor-widget elementor-widget-text-editor\" data-id=\"727ffcd\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>How an order applies<\/h2><p>The order is addressed to the provider and covers the data in its possession or control. The customer then depends on what the provider does with the request.<\/p><p>Under 18 U.S.C. \u00a7 2703(h), the provider may move to quash or modify the order if it believes that the customer is not a \u201cUnited States person\u201d, does not reside in the United States, and that disclosure would create a material risk of violating the laws of a \u201cqualifying foreign government\u201d. It has 14 days after service to do so.<\/p><p>A \u201cqualifying foreign government\u201d is a country that has concluded an executive agreement with the United States that has entered into force. The US Department of Justice publishes agreements with the United Kingdom, signed on 3 October 2019, and with Australia, signed on 15 December 2021. No agreement is in force with the European Union; EU\u2013US negotiations on electronic evidence resumed in 2023. The Department\u2019s page mentions no agreement with France.<\/p><p>The consequence: the challenge mechanism specific to \u00a7 2703(h) presupposes such an agreement. A French business should not count on this remedy as an established protection.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f396bdc elementor-widget elementor-widget-text-editor\" data-id=\"f396bdc\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Why the location of the disk is not enough<\/h2><p>The law\u2019s criterion is control, not geography. Take an industrial SME with two sites that has chosen a European data region with a US software vendor. Its messages are stored in Europe. But the company that administers the service and can restore a mailbox remains American. Faced with an order, the storage region does not change the question: are these data under its control?<\/p><p>On 10 June 2025, before the French Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee under oath that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an order from the US government, without the explicit consent of the French authorities. His answer: \u201cNo, I cannot guarantee it, but, once again, it has never happened yet.\u201d Both halves of the sentence matter. The first describes the legal framework; the second, the practice observed by the company.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-83bffef elementor-widget elementor-widget-text-editor\" data-id=\"83bffef\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>The conflict with Article 48 of the GDPR<\/h2><p>The GDPR approaches the question from the other end. Under Article 48, a judgment of a court or a decision of an authority of a third country requiring the transfer or disclosure of personal data may only be recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty, in force between that country and the Union or the Member State.<\/p><p>A US provider operating in Europe may therefore find itself caught between two legal systems: a US order on one side, and on the other a European rule that does not recognise it without an international agreement. Article 48 does not settle this conflict on the provider\u2019s behalf. For the buyer, the issue is concrete: ask how this provider handles such a request, whether it challenges it, and whether it informs the customer when the law allows.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d668866 elementor-widget elementor-widget-text-editor\" data-id=\"d668866\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>The status of the Data Privacy Framework<\/h2><p>As of 5 October 2026, transfers from the European Union to certified US organisations can still rely on adequacy decision (EU) 2023\/1795, known as the Data Privacy Framework. This decision is in force. It is being challenged, and changes in US law have led the European Data Protection Board to ask the Commission to assess their effects. Until it is withdrawn or annulled, it remains effective.<\/p><p>The litigation continues. According to a commentary by the law firm WilmerHale published on 1 December 2025, the General Court of the European Union dismissed the action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. The law firm DAC Beachcroft sums up the situation in one phrase: stability for now, uncertainty ahead. These points are reported here on the basis of lawyers\u2019 commentaries.<\/p><p>The Data Privacy Framework governs transfers within the meaning of the GDPR. It does not take a US provider out of the scope of the CLOUD Act. A prudent business documents this legal basis and plans what to do if it falls. This monitoring belongs in the record of transfers, not in a slogan.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e38092c elementor-widget elementor-widget-text-editor\" data-id=\"e38092c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What actually reduces exposure<\/h2><p><strong>Choose the operator.<\/strong> If the company that bills, backs up and administers the service is European, and does not depend on a US group for possession of the data, a CLOUD Act order is not addressed to it. This is the main lever.<\/p><p><strong>Read the list of subcontractors.<\/strong> A European operator that sends emails, backups or support to a US subcontractor reintroduces a provider subject to US law. The list of subcontractors is part of the protection. The common mistake: checking the main hosting provider and forgetting the ticketing tool or the backup.<\/p><p><strong>Distinguish the software vendor from the operator.<\/strong> Using software whose vendor is American is not the same as entrusting the data to that vendor. Zimbra is published by Synacor, in the United States. When it is installed and backed up by a European hosting provider, in that provider\u2019s facilities, the operational holder of the mailboxes is the hosting provider. The contract must prohibit the vendor from accessing content, and state who applies the patches.<\/p><p><strong>Treat support as access.<\/strong> A technician who opens a mailbox or a backup is processing data. Where that technician is located, the record of the access and its reason matter as much as the location of the disk.<\/p><p><strong>Encrypt with a key you hold, where the service allows it.<\/strong> Encryption at rest with a key held by the provider protects against disk theft. It does not prevent the provider from reading the data to deliver the service, nor from producing them if compelled to. Encryption with a key that only you hold changes the picture for content. On a full suite, it does not always cover every stage: some stages require the service to process the content, and encryption there is then in the hands of the software vendor or the operator (filtering and quarantine, indexing for search, document processing in a CRM). The right questions are therefore: at which stages does the provider manage the key, how long do the data remain there, and who can access them? The scope has to be read.<\/p><p><strong>Keep an exit.<\/strong> Regular exports, open formats, and a restore test. Legal protection without a recoverable copy is incomplete.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73896d6 elementor-widget elementor-widget-text-editor\" data-id=\"73896d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What is not enough<\/h2><ul><li>Announcing \u201chosted in Europe\u201d without naming the operator. The exact meaning of this phrase is detailed on the page <a href='\/en\/data-hosted-in-europe\/'>data hosted in Europe<\/a>.<\/li><li>Signing a DPA and considering the matter closed. The DPA organises GDPR compliance. It does not take a US software vendor out of US law.<\/li><li>Believing that a Microsoft or Google data region cancels out the CLOUD Act. These regions describe where certain data are stored and processed. The vendor remains American.<\/li><li>Requiring SecNumCloud for an SME\u2019s email service when the real need is a European operator. SecNumCloud is a qualification of an offering, useful when the tender or the nature of the data requires it. The ANSSI catalogue states which offerings hold it. Klytic does not hold it. Nor should OVHcloud\u2019s Zimbra email offering be confused with the OVHcloud infrastructure offerings that are qualified for named scopes.<\/li><\/ul><p>Nor is the CLOUD Act the only criterion. A business with data of low sensitivity, which depends on advanced Microsoft 365 or Google Workspace features and documents the Data Privacy Framework in its record, can reasonably stay. The choice becomes questionable when it has not been made: no one has named the holder of the data or planned an exit. The pages <a href='\/en\/european-vs-american-cloud\/'>European cloud or American cloud<\/a> and <a href='\/en\/microsoft-365-vs-sovereign-solution\/'>Microsoft 365 or a sovereign solution<\/a> explore this trade-off.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2128f87 elementor-widget elementor-widget-text-editor\" data-id=\"2128f87\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>A step-by-step approach<\/h2><ol><li>List the processing activities: email, files, CRM, telephony, backups, support.<\/li><li>For each one, name the company that holds the data.<\/li><li>Exclude or regulate those that are US providers with control of the content.<\/li><li>Write down the list of subcontractors and review it every year.<\/li><li>Test an export.<\/li><\/ol><p>Example: a 25-person accounting firm that goes through this exercise often finds that the email service is clearly identified, but that the e-signature tool, file sharing with clients or the backup were added without checking the operator. These are the lines to regulate first.<\/p><p>The checks specific to each suite are on the pages <a href='\/en\/gdpr-microsoft-365\/'>GDPR and Microsoft 365<\/a> and <a href='\/en\/gdpr-google-workspace\/'>GDPR and Google Workspace<\/a>; the general criteria, in <a href='\/en\/what-is-sovereign-cloud\/'>what is a sovereign cloud<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5c042c elementor-widget elementor-widget-text-editor\" data-id=\"e5c042c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2><h3>Is a datacenter in France enough to rule out the CLOUD Act?<\/h3><p>No. The law targets the provider subject to US law that has possession or control of the data, wherever they are stored. The location of the disk remains useful, but it does not answer the question of the operator.<\/p><h3>Can the provider challenge an order?<\/h3><p>\u00a7 2703(h) provides for a motion to quash or modify, within 14 days of service. This remedy presupposes an executive agreement in force with the country concerned. The US Department of Justice page mentions no agreement with France, and none is in force with the European Union.<\/p><h3>Does Article 48 of the GDPR protect my data?<\/h3><p>It sets a European rule: a foreign decision is recognised only if it is based on an international agreement in force. It places the US provider in a conflict of laws, without resolving it on the provider\u2019s behalf.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-90cdf3b kly-g-klytic elementor-widget elementor-widget-text-editor\" data-id=\"90cdf3b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Where Klytic stands<\/h2><p>Dedicace Software, a French company, operates Klytic. Hosting is provided in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the customer\u2019s servers. The email software is Zimbra, published in the United States: protection comes from the operator and the operating contract, not from the vendor\u2019s nationality. The software vendor has no access to the data and cannot compel Klytic to hand them over.<\/p><p>The data are held entirely by the customer, or by Klytic on the customer\u2019s behalf, in a geographical area that falls under the applicable jurisdiction. They are encrypted natively, or according to the customer\u2019s choice. The key is held by the customer, or kept in the customer\u2019s account, and Klytic has no access to it.<\/p><p>Some stages rely on encryption managed by Klytic, because the service has to process the content: emails and documents processed in the CRM, and emails placed in quarantine by the filtering, which are encrypted in the database. The exception is the email service: if the customer has not enabled encryption with its own key, its emails are stored encrypted with a key managed by Klytic. Conversely, emails encrypted by the customer can be indexed for search if the customer has given its key to its email client.<\/p><p>In transit, emails are encrypted from the moment they pass through Klytic MTA filtering, then between the platform\u2019s servers, and on every access to the mailbox: webmail, email client or mobile, from the company network as well as from outside. Only one stage does not depend on Klytic: sending to another domain. Encryption is maintained there when the recipient\u2019s server supports it, which is often the case; otherwise, the message makes this last journey in clear text, as with any email provider. To guarantee confidentiality all the way to the recipient in every case, the message itself must be encrypted (S\/MIME or PGP).<\/p><p>Access to files is tightly restricted through limited access rights, and a connection audit raises an alert in the event of a fraudulent attempt. As with any provider, the contract must describe this possession, this encryption and their scope. See also the page <a href='\/en\/hosting-sovereignty\/'>hosting and sovereignty<\/a>.<\/p><p>Klytic does not hold the SecNumCloud qualification. None of these statements constitutes general immunity: a French operator remains subject to French law.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e79add3 kly-g-disclaimer elementor-widget elementor-widget-text-editor\" data-id=\"e79add3\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>This page describes a general framework. It does not constitute legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-09637fe kly-g-legal elementor-widget elementor-widget-text-editor\" data-id=\"09637fe\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><b>Legal status as of 5 October 2026.<\/b> This text does not replace a contract review. The EU\u2013US adequacy decision (EU) 2023\/1795 is in force. It is being challenged. The ANSSI catalogue is authoritative for SecNumCloud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-90afce8 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"90afce8\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Accessed in October 2026.<\/p><ul><li>18 U.S.C. \u00a7 2713, text introduced by the CLOUD Act: disclosure of data in the provider\u2019s possession or control, including outside the United States. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2023-title18\/html\/USCODE-2023-title18-partI-chap121-sec2713.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><li>18 U.S.C. \u00a7 2703, including subsection (h): the provider\u2019s motion to quash or modify, 14-day time limit, concept of a qualifying foreign government. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2022-title18\/html\/USCODE-2022-title18-partI-chap121-sec2703.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><li>U.S. Department of Justice, CLOUD Act Resources: agreements with the United Kingdom and Australia, negotiations with the European Union. <a href='https:\/\/www.justice.gov\/criminal\/cloud-act-resources' rel='noopener' target='_blank'>justice.gov<\/a><\/li><li>Regulation (EU) 2016\/679 (GDPR), Article 48: third-country decisions and international agreements. <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32016R0679' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>French Senate, commission of inquiry on public procurement, record of the week of 9 June 2025 (hearing of 10 June 2025). <a href='https:\/\/www.senat.fr\/compte-rendu-commissions\/20250609\/ce_commande_publique.html' rel='noopener' target='_blank'>senat.fr<\/a><\/li><li>Implementing Decision (EU) 2023\/1795 of 10 July 2023, adequacy under the Data Privacy Framework. <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32023D1795' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>European Commission, list of adequacy decisions still published, including the United States. <a href='https:\/\/commission.europa.eu\/law\/law-topic\/data-protection\/international-dimension-data-protection\/adequacy-decisions_en' rel='noopener' target='_blank'>commission.europa.eu<\/a><\/li><li>On the litigation and the ongoing review, legal commentary, not a decision: DAC Beachcroft, \u201cThe EU\u2013US Data Privacy Framework: stability for now, uncertainty ahead\u201d. <a href='https:\/\/www.dacbeachcroft.com\/en\/What-we-think\/The-EU-US-Data-Privacy-Framework-Stability-for-now-uncertainty-ahead' rel='noopener' target='_blank'>dacbeachcroft.com<\/a><\/li><li>On the General Court\u2019s dismissal of the action and the appeal, legal commentary, not a decision: WilmerHale, \u201cEuropean Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework\u201d, 1 December 2025. <a href='https:\/\/www.wilmerhale.com\/en\/insights\/blogs\/wilmerhale-privacy-and-cybersecurity-law\/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework' rel='noopener' target='_blank'>wilmerhale.com<\/a><\/li><li>ANSSI, SecNumCloud FAQ. <a href='https:\/\/cyber.gouv.fr\/enjeux-technologiques\/cloud\/faq-qualification-secnumcloud\/' rel='noopener' target='_blank'>cyber.gouv.fr<\/a><\/li><li>Zimbra, FAQ (software vendor: Synacor). <a href='https:\/\/www.zimbra.com\/faqs\/' rel='noopener' target='_blank'>zimbra.com\/faqs<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-25a48fe e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"25a48fe\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6051e3a elementor-widget elementor-widget-html\" data-id=\"6051e3a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"Contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-03088ca elementor-widget elementor-widget-text-editor\" data-id=\"03088ca\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>A French operator for your data<\/h3><p>Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/hosting-sovereignty\/\">Klytic hosting<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-52122b1 e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"52122b1\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1bcf20c elementor-widget elementor-widget-text-editor\" data-id=\"1bcf20c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Read next<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/data-hosted-in-europe\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">What does \u201cdata hosted in Europe\u201d really mean?<\/span><span class=\"q\">\u201cHosted in Europe\u201d refers to an announced storage location. It says nothing about who operates, where backups and logs go, or where support connects from.<\/span><span class=\"m\"><span>8 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/gdpr-microsoft-365\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">GDPR and Microsoft 365: what a business needs to check<\/span><span class=\"q\">Roles, DPA, EU Data Boundary, transfers, data subject rights and exit: the GDPR checks to carry out before closing the Microsoft 365 question.<\/span><span class=\"m\"><span>9 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/european-alternatives-microsoft-365\/\" style=\"--cat:#6d28d9\"><span class=\"c\">Comparisons<\/span><span class=\"t\">European alternatives to Microsoft 365: 2026 guide<\/span><span class=\"q\">Selection criteria, then Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players and Klytic. When each one is relevant.<\/span><span class=\"m\"><span>18 min read<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-539316dd e-con e-atomic-element e-div-block-base e-default-div e-c9fd865-4a50 \" data-id=\"539316dd\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"539316dd\" data-e-type=\"e-div-block\" data-id=\"539316dd\">\n    <div class=\"elementor-element elementor-element-4f79afcb e-con e-atomic-element e-div-block-base e-default-div e-4fa9fe-ce86 \" data-id=\"4f79afcb\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"4f79afcb\" data-e-type=\"e-div-block\" data-id=\"4f79afcb\">\n    \t\t\t<p class=\"e-4dcf5c70-2ec7 e-paragraph-base e-default-p\" data-interaction-id=\"330a7a35\" data-e-type=\"widget\" data-id=\"330a7a35\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"56f1f7d5\" class=\"e-347faa43-4e20 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"56f1f7d5\">30-day free trial, assisted migration<\/h2>\n\t\t\t\t\t<p class=\"e-7f6310da-1caa e-paragraph-base e-default-p\" data-interaction-id=\"2ce27288\" data-e-type=\"widget\" data-id=\"2ce27288\">No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.<\/p>\n\t\t<div class=\"elementor-element elementor-element-35ea29a1 e-con e-atomic-element e-div-block-base e-default-div e-1cd48b22-e6da \" data-id=\"35ea29a1\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"35ea29a1\" data-e-type=\"e-div-block\" data-id=\"35ea29a1\">\n    \t\t\t<a href=\"https:\/\/eu.klytic.com\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-4a7886e3-652d e-button-base e-default-a\" data-interaction-id=\"19bfa8f1\" data-e-type=\"widget\" data-id=\"19bfa8f1\">\n\t\ud83d\ude80 Start free trial\n<\/a>\n\t\t\t\t\t<a href=\"https:\/\/eu.klytic.com\/en\/pricing\/\" target=\"_self\" class=\"e-137e863d-dd0d e-button-base e-default-a\" data-interaction-id=\"326d82ab\" data-e-type=\"widget\" data-id=\"326d82ab\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Accueil\u203aGuides\u203aSouverainet\u00e9 Souverainet\u00e9 Comment prot\u00e9ger une entreprise du CLOUD Act ? On prot\u00e8ge une entreprise du CLOUD Act en choisissant qui d\u00e9tient les donn\u00e9es, pas en d\u00e9pla\u00e7ant seulement les serveurs. La loi am\u00e9ricaine de 2018 permet \u00e0 une autorit\u00e9 des \u00c9tats-Unis, dans une proc\u00e9dure, d\u2019exiger d\u2019un prestataire soumis \u00e0 ses juridictions les donn\u00e9es que ce prestataire [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_titles_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_social_fb_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_social_twitter_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-3288","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=3288"}],"version-history":[{"count":2,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3288\/revisions"}],"predecessor-version":[{"id":3382,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3288\/revisions\/3382"}],"wp:attachment":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=3288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}