Sovereign Cloud Wars: Data Localization Mandates Collide with the US CLOUD Act

The Collision Course

Two irreconcilable legal frameworks are converging in 2026, and the world’s largest technology companies are caught in the middle. On one side, the European Union’s cloud sovereignty initiatives and a growing number of national data localization mandates require that certain categories of data be stored and processed within specific jurisdictions, beyond the reach of foreign government access. On the other side, the US CLOUD Act asserts that American technology companies must provide US law enforcement with access to data they control, regardless of where that data is physically stored.

These two legal regimes cannot both be fully complied with. A European company using an American cloud provider faces a scenario where the provider is simultaneously obligated under EU law to keep the data within EU jurisdiction and beyond US government reach, and obligated under US law to produce the data to US authorities upon receipt of a valid legal process. This is not a hypothetical conflict — it is a live legal contradiction that companies are navigating daily.

The stakes escalated dramatically in February 2026, when a State Department cable dated February 18 and signed by Secretary of State Marco Rubio directed American diplomats worldwide to push back against foreign data localization requirements. The cable called for “a more assertive international data policy” and urged diplomats to “counter unnecessarily burdensome regulations, such as data localisation mandates,” characterizing them as measures that would hinder the free flow of data, drive up costs and cybersecurity risks, restrict AI and cloud-based services, and broaden government control.

The cable’s disclosure inflamed the debate. European officials responded by accelerating their sovereign cloud initiatives. Several Asian and Middle Eastern governments cited the cable as evidence that their data localization concerns were well-founded. The collision that had been building for years became fully visible.

The EU Cloud Sovereignty Push

The EU’s approach to cloud sovereignty has evolved from an aspirational concept into an increasingly detailed regulatory framework, though key elements remain under debate.

The European Cloud Services Certification Scheme (EUCS), developed by ENISA under the EU Cybersecurity Act, establishes a tiered classification system for cloud services. Earlier EUCS drafts included explicit sovereignty-based eligibility restrictions — such as headquarters location and jurisdictional exclusions for non-EU providers — though these requirements were removed in recent revisions amid fierce debate between member states advocating digital autonomy and those prioritizing open markets. The European Commission’s Cloud Sovereignty Framework, currently applied as a procurement procedure internal to the Commission, is expected to be elevated to a legal standard across all public buyers through the 2026 Cybersecurity Act revision.

The sovereignty requirements at the highest tier would demand that data be stored exclusively within EU territory, that the cloud infrastructure be owned and operated by entities not subject to the jurisdiction of any non-EU government, that encryption keys be managed within the EU by EU entities, and that no non-EU government can compel access to the data through any legal mechanism.

This last requirement is the heart of the conflict. Under the US CLOUD Act, American cloud providers — including AWS, Microsoft Azure, and Google Cloud, which together account for approximately 70% of the European cloud market according to Synergy Research Group — can be compelled by US courts to produce data regardless of its physical location. The EU’s sovereign cloud initiatives are explicitly designed to prevent this extraterritorial access, which means that American cloud providers would be structurally excluded from offering sovereign-tier services unless they create legally independent European entities.

The EU e-evidence regulation (Regulation 2023/1543), which takes effect on August 18, 2026, adds another layer. It establishes a framework for cross-border access to electronic evidence within the EU through European Production Orders and Preservation Orders, creating a European alternative to the mutual legal assistance treaties that currently govern cross-border data requests. The regulation is designed to demonstrate that the EU can facilitate legitimate law enforcement access to data without relying on extraterritorial mechanisms like the CLOUD Act.

The US CLOUD Act and the State Department Pushback

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted on March 23, 2018, was the US response to a legal vacuum created by the Microsoft Ireland case. In that case, Microsoft challenged an FBI warrant to produce emails stored on servers in Ireland, arguing that the Stored Communications Act did not extend to data held overseas. Congress mooted the pending Supreme Court case by passing the CLOUD Act, which explicitly authorized US law enforcement to compel data production from US-based providers regardless of where the data was stored.

The CLOUD Act includes a mechanism for resolving conflicts with foreign law. It allows US providers to challenge a data production order if compliance would violate the laws of a “qualifying foreign government” — one that has entered into an executive agreement with the US providing for mutual data access. The US and UK signed the first such agreement in 2019 (entering into force on October 3, 2022), and the US has reportedly been negotiating with Australia and Canada. However, no US-EU CLOUD Act agreement has been finalized — the EU and the US agreed to negotiate a single agreement rather than bilateral agreements with individual member states, but progress has been slow.

The February 2026 State Department cable represents a significant escalation. Previously, the US government’s position on data localization had been articulated through trade policy channels — in bilateral trade negotiations, at the World Trade Organization, and through the US Trade Representative’s annual trade barrier reports. The cable moved the pushback into diplomatic channels, directing ambassadors and senior diplomats to raise the issue directly with foreign government ministers. Diplomatic missions were instructed to challenge proposed regulations, monitor emerging data sovereignty initiatives, and promote international frameworks such as the Global Cross-Border Privacy Rules Forum.

The cable’s leak has given data sovereignty advocates what they characterize as documentary evidence that the US government views data localization as a threat to American commercial interests and is actively working to undermine sovereign data governance initiatives worldwide.

How Multinationals Are Responding

Caught between incompatible legal regimes, multinational technology companies are pursuing several strategies, each with significant limitations.

The dominant strategy among major cloud providers is structural separation. AWS launched its European Sovereign Cloud in December 2025, with general availability announced in January 2026. Backed by a 7.8 billion euro investment, the infrastructure is entirely located within the EU, physically and logically separate from other AWS regions, managed through dedicated European legal entities established under German law, and operated exclusively by EU-resident employees. AWS has committed to zero operational control from outside EU borders, with the first region in Brandenburg, Germany, and planned expansion to Belgium, the Netherlands, and Portugal.

Microsoft has pursued a partnership approach, working with Bleu (a joint venture between Orange and Capgemini) in France and Delos Cloud (an SAP subsidiary) in Germany to create sovereign cloud offerings designed to meet national security certification requirements (SecNumCloud in France, Cloud Platform Requirements in Germany). Google Cloud has launched sovereign solutions including Google Cloud Dedicated (operated with partners Thales in France and T-Systems in Germany) and established a Sovereign Cloud Hub in Munich in November 2025.

The critical question is whether these structural separations actually achieve legal independence from the CLOUD Act. Legal scholars are divided. Some argue that a US parent company can be compelled to direct its foreign subsidiaries to produce data, rendering the subsidiary structure ineffective. Others argue that a properly structured independent subsidiary — with its own board, its own management, and contractual limitations on the parent company’s control — could successfully resist a CLOUD Act order. The issue has not been definitively resolved by any court.

IBM has taken a different approach with its Sovereign Core platform, announced in January 2026, which gives customers complete control over encryption keys, access permissions, and data location. IBM’s Keep Your Own Key (KYOK) technology uses FIPS 140-2 Level 4 certified hardware to ensure that even IBM itself cannot access customer data. The theory is that if IBM cannot access the data, a CLOUD Act order directed at IBM cannot compel production of data it cannot reach.

European cloud providers — including OVHcloud, Deutsche Telekom, and Scaleway — are positioning themselves as sovereign alternatives inherently immune to CLOUD Act jurisdiction. These providers are not subject to US law and cannot be compelled by US courts to produce data. However, European cloud providers collectively hold only about 15% of their home market, with SAP and Deutsche Telekom leading at roughly 2% each. Despite substantial government support — including more than 3 billion euros through the IPCEI-CIS program — they face significant challenges in matching the scale, capability, and reliability of the American hyperscalers.

Asia-Pacific and Middle East Developments

The sovereign cloud trend extends well beyond Europe. Several Asia-Pacific and Middle Eastern jurisdictions are implementing data localization requirements that create similar tensions.

Indonesia’s Government Regulation No. 71 (GR71) requires public electronic system operators to place their systems and data within Indonesian territory. Private operators have more flexibility but face registration and supervision requirements. Enforcement began in October 2024, with penalties of up to 2% of annual revenue for non-compliance. The regulation establishes a framework of “strategic electronic data” that must be protected, covering sectors including government, financial services, and healthcare.

Vietnam has one of the most stringent localization regimes in ASEAN. The Cybersecurity Law and Decree 53/2022 require foreign providers of telecommunications, social networking, e-commerce, and payment services to store specific user data locally upon government request. The 2024 Law on Data (effective July 2025) expanded regulation to all digital data, introducing “important data” and “core data” categories that face transfer restrictions. A new Personal Data Protection Law (effective January 2026) introduces revenue-based penalties of up to 5% of annual revenue for cross-border transfer violations.

Saudi Arabia’s Personal Data Protection Law (PDPL), in full enforcement since September 14, 2024, requires companies to store sensitive and personally identifiable data within Saudi Arabia unless specific exemptions are granted. The Cloud Computing Services Provisioning Regulations further mandate that no public sector data be transferred outside Saudi territory. The Kingdom has invested heavily in domestic cloud infrastructure through Vision 2030, including partnerships with US providers to establish Saudi-based cloud regions.

The United Arab Emirates has taken a multi-layered approach, with the federal Personal Data Protection Law (Decree Law No. 45 of 2021) permitting cross-border transfers to jurisdictions with adequate data protection, while free zones like DIFC and ADGM maintain their own frameworks with separate adequacy lists. The UAE permits data flows more freely than many regional peers but retains the legal authority to restrict them.

India’s Digital Personal Data Protection Act (2023), with draft rules released in January 2025, established a “blacklist” model where personal data can flow to any country except those specifically restricted by the central government. While the government has not yet exercised broad restriction authority, the framework provides a mechanism for data localization that could be activated at any time, and significant data fiduciaries face additional transfer restrictions.

The Long-Term Trajectory

The sovereign cloud conflict is not moving toward resolution — it is intensifying. Three structural factors ensure continued escalation.

First, the underlying legal conflict between the CLOUD Act and data sovereignty mandates has no diplomatic solution in sight. US-EU CLOUD Act negotiations have been ongoing since 2020 without producing an agreement. The fundamental disagreement — whether US law enforcement should have extraterritorial access to data held by US companies — reflects genuinely incompatible views of sovereignty that cannot be easily compromised.

Second, the commercial stakes are enormous. The global cloud infrastructure services market exceeded $400 billion in annual spending in 2025, with American companies holding the dominant share (AWS at 30%, Microsoft Azure at 20%, Google Cloud at 13% as of Q2 2025). Data localization requirements threaten to fragment this market along national lines. Conversely, the absence of data localization requirements leaves non-US governments and companies dependent on infrastructure controlled by entities subject to US legal jurisdiction — a dependency that many governments view as an unacceptable sovereignty risk.

Third, the number of jurisdictions implementing data localization requirements is growing. By early 2023, the OECD had identified 100 data localization measures across 40 countries, with more than half emerging in the previous decade. More than two-thirds combined local storage requirements with flow prohibition — the most restrictive form. The count has continued to rise since, with each new provision adding complexity to the global cloud compliance landscape.

The most likely medium-term outcome is continued fragmentation. Cloud providers will maintain multiple legally separate entities and infrastructure stacks to serve different regulatory zones. Customers will face higher costs as the efficiencies of global cloud infrastructure are sacrificed to sovereignty requirements. And governments will continue to assert their authority over data generated and processed within their borders, even as that data becomes increasingly central to economic activity that is inherently global.

For technology leaders and policymakers, the sovereign cloud wars are not a problem to be solved but a condition to be managed. The tension between data sovereignty and global digital commerce is a permanent feature of the modern technology landscape, and strategies must be designed for indefinite navigation of that tension rather than its resolution.

Frequently Asked Questions

Sources & Further Reading

• US Tells Diplomats to Lobby Against Foreign Data Sovereignty Laws — TechCrunch
• Opening the AWS European Sovereign Cloud — Amazon Web Services
• E-Evidence Regulation: New Obligations for Service Providers from 2026 — Heuking
• European Cloud Providers’ Local Market Share Holds Steady at 15% — Synergy Research Group
• Landmark US-UK Data Access Agreement Enters into Force — US Department of Justice
• IBM Introduces New Software to Address Growing Digital Sovereignty Imperative — IBM Newsroom
• The Nature, Evolution and Potential Implications of Data Localisation Measures — OECD
• Cloud Sovereignty Framework — European Commission