The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was adopted by the United States of America (US) Congress on 23 March 2018 with the aim to improve procedures for both the US and foreign authorities in obtaining access to data held by service providers in the context of criminal investigations. The CLOUD Act has two main parts. First, it amends the Stored Communication Act, so as to make explicit the obligation of US service providers to preserve and produce data they control regardless of where it is stored. Second, it authorizes the US to enter into so-called executive agreements with foreign governments, thereby removing domestic law restrictions so that service providers based in one of the countries party to the agreement can comply with direct orders for disclosure of electronic data issued by the other country.

This document provides information on both parts of the CLOUD Act and their scope of application, including the challenges related to their implementation. It also analyses provisions of the two executive agreements concluded by the end of 2022 (US-UK Executive Agreement and US-Australia Executive Agreement).

The document was prepared within the framework of the SIRIUS Project. The SIRIUS Project has received funding from the European Commission’s Service for Foreign Policy Instruments under Contribution Agreement No PI/2020/417-500.