Your M365 contract won't save you from the CLOUD Act, but a paper trail might
Here's an uncomfortable fact most engineering teams don't think about until a client or auditor forces the issue: your company's email, calendar, and files probably live under US jurisdiction regardless of which Azure or GCP region you picked in the admin console. Region settings control where bytes sit on disk. They don't control which country's courts can compel the provider to hand them over.
Most teams never actually test this. They assume it, worry about it in a Slack thread, then move on. The fix is simpler than people expect: write down the right questions, send them to your provider in writing, and keep the answers on file.
This isn't about catching Microsoft or Google in some conspiracy. Their engineering and security teams are solid. The real issue is jurisdiction, not product quality, and jurisdiction is a documentation problem you can actually solve.
Before you send anything
Three things to nail down first:
- Find your actual contracting entity. If you bought M365 through a reseller or MSP, your questions route through them first, not directly to Microsoft. Figure this out before drafting anything.
- Scope the data type precisely. Mailbox content, Teams transcripts, OneDrive files, and metadata (sender/recipient lists) can fall under different policies inside the same provider. Don't ask a vague question and expect a precise answer.
- Expect legally careful answers, not evasive ones. A US provider's legal team will answer using their own policy language. That's normal. Compare it against the actual law, not against what you hoped to hear.
For background on why this matters legally, see the earlier piece on GDPR compliance for email providers. This post assumes you already know roughly what the CLOUD Act is.
The questions to send (as a template)
Send these as a numbered RFI to your account manager, with a request to forward to legal/compliance. Written answers only, no calls. A call gives you a vibe; an email gives you evidence.
Subject: Written RFI - Data jurisdiction and disclosure questions
1. Which legal entity is our data processor, and in which country is it incorporated?
2. Does storing our data in an EU region change which country's law enforcement can compel disclosure?
3. Have you ever received a request for our data from a US authority, and could you tell us if you had?
4. Can you guarantee our data will never be disclosed to the US government without our consent or our national authorities' consent?
5. What is the current legal basis for transferring our personal data to the United States?
6. Is that legal basis currently being challenged, and what's the contingency if it's struck down?
7. Can a US court order override our European data processing agreement?
8. Who, specifically, can access our mailbox/file content, and under what process?
Why these eight, specifically
Q1 is the whole ballgame. The CLOUD Act applies based on where the company is incorporated, not where servers sit. If the answer names Microsoft Corporation or Google LLC as the controlling entity, you already have your answer regardless of what follows.
Q2 kills a common misconception. "EU data boundary" and "data residency in Europe" are storage-location features, not sovereignty guarantees. Same company, same keys, same exposure to a US court order. Get this distinction confirmed in writing.
Q3 exposes the gag-order problem. Many government data requests come with a legal bar on notifying the customer. A provider that can't promise notification isn't stonewalling you, they're describing the law. Still worth having on paper.
Q4 has already been answered publicly, which makes it a useful litmus test. On 10 June 2025, Microsoft France's director of public and legal affairs, Anton Carniaux, testified before a French Senate inquiry. Asked if he could guarantee UGAP-hosted data would never be handed to US authorities without explicit French agreement, he said: "Non, je ne peux pas le garantir," adding it hadn't happened so far. No guarantee, no known incident. If your provider's answer looks similar, that's consistent with the law, not a provider-specific red flag.
Q5 pins down the transfer mechanism. Under GDPR, personal data leaving the EEA needs an adequacy decision or safeguards like SCCs. For most US providers today, the answer is the EU-US Data Privacy Framework, adopted 10 July 2023.
Q6 is the real test. The DPF is the third attempt at an EU-US transfer deal. Safe Harbor died in 2015. Privacy Shield died in 2020 over inadequate remedies for EU citizens under US surveillance law. The DPF itself is mid-challenge right now: dismissed by the EU General Court on 3 September 2025, appealed on 31 October 2025, pending before the CJEU with no ruling yet. Ask for the concrete fallback plan, not a restatement that the current framework is valid today.
Q7 forces the conflict-of-laws admission. GDPR Article 48 says a foreign court order doesn't automatically make a transfer lawful. Ask the provider how they reconcile that with US legal obligations when the two clash. Most will answer carefully here, because there's a real, unresolved conflict.
Q8 is operational. Does access require a warrant/subpoena/court order with internal legal review, or is it closer to automatic compliance? This tells you whether anyone would push back on your behalf.
What to do with the answers
File all eight, in writing, with your data processing records. When a client or auditor asks "what happens if a US court comes knocking," you now have a documented position instead of a shrug.
Read the full original article on binadit.com
Originally published on binadit.com
Top comments (0)