Many Swiss companies use Microsoft 365, Google Workspace or AWS with data centres in Switzerland and assume their data is thus beyond foreign authorities’ reach. The CLOUD Act shows why that is not entirely true.
What the CLOUD Act regulates
The Clarifying Lawful Overseas Use of Data Act of 2018 clarifies that providers of electronic communication and cloud services subject to US jurisdiction must, on a lawful order, produce data in their possession, custody or control, even if stored outside the US. Providers can challenge orders that would violate foreign law, but the procedure for this is limited.
Significance for Swiss companies
Storage in Switzerland reduces many risks, for example regarding transfers abroad under the FADP, but does not rule out access via the CLOUD Act if the provider is a US company or part of a US group. Whether that matters depends on the data: for much business data the risk is low; for professional secrets, health data or particularly sensitive client data it can be decisive.
Measures
Encryption with customer-managed keys so the provider has no access to plaintext; data minimisation so sensitive content never sits in the cloud; choosing a provider without a US nexus for particularly sensitive data; and a documented risk assessment, as also required for transfers to the US.
Context
The CLOUD Act is no reason to avoid US cloud services altogether, but a reason to decide deliberately which data sits where. The trade-off between Swiss providers and hyperscalers is described in our decision guide Swiss or EU hosting.