A US-owned provider’s EU data centre doesn’t remove Cloud Act exposure. The legal requirement and the technical choice are two different problems, and buyers who conflate them end up buying the wrong protection.
The question procurement is actually asking
Every procurement call now has a moment where someone says “GDPR” and someone else says “Cloud Act” and both sides nod as though they mean the same thing. They don’t. GDPR is a legal requirement on how personal data is transferred and who is accountable for it. The Cloud Act is a US law about who a US company must hand data to, on request, regardless of where that data physically sits. A vendor can be fully GDPR-compliant on paper and still fall inside Cloud Act reach. Buyers searching for “data residency eu saas” are usually trying to close that gap, not asking a geography question.
Two different problems wearing one name
GDPR’s Articles 44 to 49 govern international transfers of personal data; Article 28 governs what a processor must contractually commit to. Neither article says “your servers must be in the EU.” What they require is a lawful transfer mechanism when data leaves the EEA, and a processor who is accountable, auditable, and bound by data protection terms. Where the hardware sits is a technical choice a vendor makes to reduce that transfer complexity — useful, often necessary in practice, but not itself the legal requirement. Treating “our data centre is in Frankfurt” as the answer to a DSGVO-konforme Cloud question is the first place buyers get misled, because it answers the technical half and skips the legal one entirely.
The EU data centre that doesn’t remove Cloud Act exposure
Here is the part that actually matters for cloud act gdpr saas risk: the Cloud Act applies to a company, not to a building. If your provider is a US-incorporated entity — or a subsidiary of one — US law enforcement can compel it to produce data it controls, no matter which country the servers are in. AWS Frankfurt, Azure Germany, Google’s European regions: all run by companies headquartered in the US, all reachable under the Cloud Act. An EU data centre satisfies data-residency marketing copy. It does not change which government can serve a warrant. This is the actual meaning of “digital sovereignty europe” as a procurement concern, and it’s why buyers who understood only “where are the servers” have been asking the wrong question.
What to actually check
A residency claim is only as good as four things behind it, and a vendor’s marketing page rarely mentions all four:
- Processor location — not the data centre region, the legal entity operating it, and its jurisdiction of incorporation.
- Sub-processor chain — who else touches the data downstream (support tooling, logging, backup, monitoring), disclosed by name, not by category.
- Encryption key custody — who holds the keys. If the provider holds them and the provider is US-jurisdiction, encryption at rest doesn’t block a compelled disclosure; they can be compelled to decrypt.
- Audit rights — whether you can actually see sub-processor changes, access logs, and government-request notices, or whether the contract only promises “commercially reasonable efforts.”
A clause that reads well and does none of this:
“Customer data will be stored in data centers located within the European Union.”
It says nothing about who operates those centres, who holds the keys, whether support staff outside the EU can access the data, or whether the vendor will notify you of a government request before complying. It’s true, and it closes none of the gap.
What sovereignty costs, and when it’s worth it
Full sovereignty — EU-owned infrastructure, EU-held keys, an EU-incorporated processor with no US parent — removes the Cloud Act question entirely. It also costs more and narrows vendor choice: the pool of EU-native providers at hyperscaler maturity is smaller, tooling is sometimes a step behind, and switching from AWS or Azure has real migration cost in engineering time for a mid-sized SaaS stack. That trade-off isn’t a reason to default to either extreme. Health data, government contracts, and anything covered by sector-specific rules should go fully sovereign — the exposure is not worth the convenience. A marketing analytics pipeline with pseudonymised data may be fine on a hyperscaler’s EU region with a properly drafted Article 28 contract and real audit rights. The right answer depends on what the data is, not on a blanket rule that “EU cloud” solves it. Buyers who ask “digitale Souveränität — do we need it everywhere?” are asking the right question; the answer is almost always no, but for the data that matters most, the answer is almost always yes.