# What Is the CLOUD Act? Cross-Border Data Rules | Kodex Source: https://www.kodexglobal.com/glossary/cloud-act > The CLOUD Act governs US access to data stored abroad and enables bilateral data agreements. Learn what it requires and how conflicts are resolved. Compliance & Regulation ## CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. Also known as Clarifying Lawful Overseas Use of Data Act The CLOUD Act was Congress’s answer to a specific stalemate. Microsoft had refused a US warrant for email stored in Ireland, arguing the warrant could not reach outside US territory. The case reached the Supreme Court and was mooted when Congress legislated. ### What the CLOUD Act settled The first half of the statute is short and consequential: a US provider must preserve and produce data within its possession, custody, or control, regardless of whether that data is stored inside or outside the United States. This replaced a territorial test with a control test. Where the bytes physically sit stopped being the question. Whether the provider can reach them became the question. ### The bilateral agreement framework The second half addresses the reverse direction. Foreign governments investigating their own crimes frequently need data held by US providers, and the MLAT route took the better part of a year. The CLOUD Act allows the US to enter executive agreements with qualifying countries, under which their authorities can serve orders on US providers directly. Qualification is conditional. A partner country must afford robust substantive and procedural protections for privacy and civil liberties, and agreements carry restrictions including that orders may not target US persons or people located in the United States. CLOUD Act agreementMLAT Who serves the provider The foreign authority directly Domestic authority, after review Typical timeline Days to weeks Many months Government-to-government review of each request No Yes Available to any country No, only qualifying partners Wherever a treaty exists ### Conflict of laws Removing the territorial limit created an obvious problem: a US order could require a provider to do something another country’s law forbids. The comity mechanism lets a provider move to quash where the target is neither a US person nor located in the US and compliance would risk violating a qualifying foreign partner’s law. Courts weigh factors including the interests of both governments and the target’s connection to each. This is narrower relief than it first appears. It applies to qualifying foreign governments, and it does not resolve every tension. The relationship between US orders and the GDPR, in particular, is still argued over rather than settled. ### What it means for a company receiving requests - Storage location is not a defence to a valid US order if you control the data. - Check whether an order arrives under a CLOUD Act agreement, since that changes who may lawfully serve you and what limits apply. - Raise genuine conflicts early. The comity route exists, but it requires being invoked rather than discovered afterwards. - Expect the map to keep changing. New agreements come into force periodically, and each expands who can reach you directly. FAQ ### Frequently asked questions Does the CLOUD Act mean data location no longer matters? For the question of whether a US provider must respond to US legal process, largely yes. The test is control, not storage location. Data location still matters for other purposes, including local data protection law, sovereignty requirements, and whether producing the data would breach another country’s law. What is a CLOUD Act agreement? A bilateral executive agreement allowing a qualifying foreign government to serve orders directly on US providers for data relating to its own investigations, bypassing the MLAT process. Qualification requires the partner country to meet standards on privacy, civil liberties, and the rule of law, and agreements exclude targeting US persons. What happens if a US order conflicts with foreign law? The CLOUD Act provides a comity mechanism: a provider can move to quash where the target is not a US person, is not located in the US, and compliance would create a material risk of violating a qualifying foreign government’s law. The court then weighs the competing interests. Glossary ### Related terms #### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. #### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. #### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Cross-border obligations are shifting. See Kodex’s guidance on the current landscape. Learn more