Can a UK business rely on US cloud providers?

What the law says

The CLOUD Act provision in 18 USC 2713 requires covered providers to comply with applicable preservation and disclosure duties for data within their possession, custody or control, whether held inside or outside the United States. Read CLOUD Act provision, 18 USC 2713.

Assess exposure to lawful requests separately from everyday account security. Ask your legal adviser to review the applicable obligations rather than relying on the server's postcode.

The UK Government's Data Access Agreement factsheet describes direct cross-border law-enforcement requests for the prevention, detection, investigation and prosecution of serious crime. Read UK Government Data Access Agreement factsheet.

Keep law-enforcement requests separate from your checks on commercial transfers. Ask which transfer route applies to your particular information.

What Microsoft has said

The Register reported that a Microsoft France executive told a French Senate hearing in 2025 that he could not guarantee protection from a legally justified US disclosure demand, while saying the situation described had not happened. Read The Register's 25 July 2025 report.

The Register also reported Microsoft's account of examining requests, resisting unfounded demands and seeking to notify affected customers. Read The Register's 25 July 2025 report.

Computer Weekly reported in June 2024 that Scottish Police Authority correspondence recorded Microsoft's inability to guarantee sovereignty for Microsoft 365 data. Read Computer Weekly's 19 June 2024 report.

Computer Weekly also reported Microsoft's response that Azure had data-protection and residency commitments and that it had worked with Police Scotland to clarify how Azure operated. Read Computer Weekly's 19 June 2024 report.

Computer Weekly's report concerns law-enforcement data and specific processing arrangements; it does not report a ruling that ordinary small-business use of Microsoft 365 is unlawful. Read Computer Weekly's 19 June 2024 report.

Read the statements in their dated context. Check your current product and contract rather than assuming an older report establishes today's arrangements.

Residency is not sovereignty

For planning purposes, data residency means where information is held. Sovereignty concerns the laws and authorities that can apply to it and its provider. Ask about processing, support access, subcontractors and legal requests as well as storage.

The ICO's international transfers guidance says a restricted transfer must be covered by adequacy regulations, appropriate safeguards or an applicable exception. Read ICO international transfers guidance.

The case for staying with the large providers

Microsoft's shared-responsibility guidance assigns customers responsibility for their data, accounts and access management, while Microsoft manages the underlying cloud infrastructure. Read Microsoft's shared-responsibility guidance.

We resell and recommend Microsoft 365. Compare its features, licence costs and the work needed to retrain your own staff with the alternatives. Moving because of a headline can introduce new dependencies and costs without resolving the legal question. This is a procurement judgement for your business, not a claim that one provider is suitable for every record.

The case for caution

Give sensitive legal, medical and personal records a specific review. Ask whether one supplier also controls your email, files, sign-in and phones. Assess the consequences of losing access to all of them together. Do not assume that your data would interest a foreign authority, or that it could never do so: neither judgement should replace a proper review.

Microsoft's consumer Services Agreement advises regular backup copies of customer content; that agreement is not the contract for every Microsoft 365 business subscription. Read Microsoft's consumer Services Agreement.

A sensible middle path

• List the information you hold and its sensitivity.
• Keep an independent recovery copy outside the primary service and test access.
• Have a second route for email and phones.
• Keep the domain registration and its DNS, the settings directing internet traffic, under business control.
• Hold your own authorised administration credentials securely.
• Document how you would export data and move.
• For the most sensitive information, assess encryption with keys you control and a tested recovery process.

Who should take this most seriously

We recommend an early review for legal and medical firms, defence suppliers and businesses whose contracts specify data location. Ask your data protection adviser to assess your actual records and contractual duties.

This page is general information, not legal advice. Speak to your data protection adviser about your own obligations.

What we can do for you

We help you agree priorities, document workarounds and check the recovery arrangements. Continuity planning is quoted as a fixed fee after a free 30 minute call. The technical fallbacks use our standard prices.

Monthly starting prices exclude VAT and use a 3 year term billed monthly. Shorter terms cost a little more. Your price and the actual fallback arrangements are confirmed in a written quote.

Questions about this service

Free tools to help you prepare

• Find your single points of failure