Adopted in the United States in 2018, the Cloud Act (Clarifying Lawful Overseas Use of Data Act) requires providers of online services subject to US jurisdiction to hand over to US authorities data they possess, control or monitor, even when that data is stored outside the United States — for example in a Swiss data centre. This extraterritorial reach lies at the heart of the tensions with the FADP and the GDPR.
Extraterritorial reach that bypasses mutual legal assistance
The Cloud Act replaces the criterion of storage location with that of control: what matters is not where the data sits, but who controls it. A US provider (Microsoft, Google, Amazon…) can therefore be compelled to disclose data hosted in Switzerland without going through the ordinary channel of international mutual legal assistance. Contractual safeguards negotiated with the provider do not bind the US authorities.
A note of caution
The Cloud Act does not stop at the provider with whom you sign. It applies to data “possessed, controlled or monitored” by any company subject to US jurisdiction — including a subcontractor, a data centre operator, a software publisher or a US subsidiary of your provider. A provider based in Switzerland or Europe can therefore be indirectly affected whenever it uses infrastructure or services from US companies (Microsoft, AWS, Google, etc.). Before choosing a provider, you must examine not only its registered office but the entire chain of subcontractors and technical dependencies. The nationality of the software is not enough to decide: US software installed on your own infrastructure, whose logs remain local and to which the publisher has no technical access, hardly exposes data to the Cloud Act. What matters is the provider’s technical ability to access the data — remote support access, telemetry, hosting or hybrid features.
FADP and GDPR: transfer rules put to the test
The FADP (art. 16 et seq.) and the GDPR (Chapter V) allow transfers of data abroad only where the recipient state offers an adequate level of protection or where appropriate safeguards are in place. Since the Schrems II ruling of the CJEU, it is clear that standard contractual clauses are not enough in the face of surveillance laws that allow access without effective control. The Cloud Act creates exactly this kind of conflict: access provided for by US law, independent of the provider’s contractual commitments.
Swiss administrations and Microsoft tools
Many cantons and municipalities use Microsoft 365, Teams or Outlook for email, storage and collaboration. The Swiss Conference of Data Protection Officers (Privatim) adopted a resolution on 18 November 2025, published on 24 November 2025: SaaS solutions from international providers — Microsoft 365 is named expressly — are in principle not suitable for processing particularly sensitive personal data or data subject to a statutory duty of confidentiality.
The reasons given: no genuine end-to-end encryption, insufficient transparency about subcontractors and updates, unilateral changes to terms, loss of control, and the fact that US providers are subject to the Cloud Act. For Privatim, use is only conceivable if the public body encrypts the data itself and the provider has no access to the keys.
The resolution is not legally binding on the Confederation, and the canton of Glarus has expressly distanced itself. Nevertheless, it sets a clear line for public authorities and supports the practice of the cantonal data protection officers.
Professions bound by secrecy: the same logic
Lawyers, doctors, notaries and other professionals bound by professional secrecy (art. 321 SCC) or by FADP/GDPR obligations must apply the same reasoning. Storing confidential files in a US provider’s email or cloud environment exposes them to access based on the Cloud Act, which is incompatible with professional secrecy. Contractual clauses, certifications or provider promises are not enough: only an architecture in which the professional retains control of the keys genuinely reduces the risk.
Practical recommendations
1. Classify data: public, ordinary business, sensitive or covered by secrecy. 2. Host sensitive data in Switzerland or Europe with providers not subject to the Cloud Act. 3. Where use of an international provider is unavoidable, apply end-to-end encryption with locally held keys. 4. Document the risk assessment (DPIA) and check the subcontracting chain. 5. Monitor official positions (Privatim, FDPIC, EDPB) and case law.
Sources
Text of the Cloud Act (H.R. 4943, United States Congress)
Swiss Federal Act on Data Protection (FADP, SR 235.1)
General Data Protection Regulation (GDPR, EU 2016/679)
Privatim — Resolution on outsourcing data processing to the cloud
CJEU, Schrems II judgment (C-311/18)
Swissinfo — Data protection officer warns Swiss authorities over US cloud risks
Heise — Switzerland: Data Protection Officers Impose Broad Cloud Ban for Authorities