Your Data Is in London. Whose Law Reaches It?

Your data can sit in a London data centre and still be within reach of a US court. The US CLOUD Act turns on whether a provider controls your data, not on where the server is, so a US-headquartered cloud's UK region does not take UK data out of US reach. That is the short answer. The more useful one covers how rarely it happens and which levers a mid-market business actually holds.

The first post in this series set out three questions for AI sovereignty: where the data sits, where the model runs and who governs it, and whose courts can compel either. It gave the third leg one paragraph and noted that jurisdiction follows the company as well as the building. This post takes that paragraph apart.

What is the US CLOUD Act?

The CLOUD Act is a US law from March 2018. The part that reaches UK businesses is one sentence long. It sits in the US code as 18 U.S.C. § 2713, and it requires providers of communication and cloud services to preserve or disclose customer data within their "possession, custody, or control", wherever that data happens to be stored.

It was written to settle a fight. Microsoft had refused a US warrant for emails held on a server in Ireland, and an appeals court had agreed with it. The case was in front of the Supreme Court when Congress passed the Act, which made it moot. The US Department of Justice describes the result modestly. The CLOUD Act simply clarified existing U.S. law on this issue, its 2019 white paper says, without lowering the legal standards a request has to meet.

Two limits are worth knowing early. The Act concerns legal process in criminal investigations, meaning warrants and court orders that still need a judge or the usual US thresholds. And US intelligence collection runs under separate law, which this post leaves aside.

What decides who can be made to hand data over

Data residency, meaning a commitment that your data is stored in a particular country, is a real answer to a real question. It decides which data protection regime governs the storage, where the physical risks sit and how quickly your systems respond. It does not decide who can be made to hand the data over, because the statute never asks where the data is. It asks who controls it.

That shifts the question from the building to the company. The Department of Justice is plain about how a court decides whether a company is within reach. Personal jurisdiction is most readily established when a company is located in the United States, and it does not stop there. The more a company has purposefully directed its conduct into the United States, the more likely a court will find the company is subject to U.S. jurisdiction. A UK-registered subsidiary of a US parent is within reach through its parent. A UK-headquartered provider with a US sales operation may be within reach in its own right. Amazon's own government request report makes the same point about the law, which applies to any service provider with operations in the U.S., not just companies with U.S. headquarters.

So "our data is in London" answers where. The questions that decide who can be made to produce it are about the provider. Who does it answer to, what does it hold in readable form, and what does it keep?

How often it actually happens

Rarely, on the providers' own numbers, and those numbers are self-reported.

Microsoft received 190 law enforcement requests worldwide for enterprise customer accounts in the second half of 2025, and was required to disclose content in 45 of them. On the question this post is about, its report is specific. Microsoft provided content data to U.S. law enforcement related to 3 non-U.S. enterprise customers whose data was stored outside the U.S. Amazon's report for the first half of 2026 puts the same question to itself. How many requests resulted in the disclosure to the U.S. government of enterprise or government content located outside the United States? Its answer is one word, "None."

The honest counterweight came in Paris in June 2025. Under oath before a French Senate inquiry, Microsoft France's director of public and legal affairs was asked whether he could guarantee that French citizens' data held through a public procurement contract would never be handed over on a US government order without French consent. His answer, recorded in the Senate's own transcript, began "Non, je ne peux pas le garantir", no, I cannot guarantee it, and went on to say that it had never yet happened.

The two answers do not contradict each other. The likelihood is low, and certainty is not available from any provider at any price, because the decision is not the provider's to make. A business that needs certainty for a particular workload needs a different arrangement for that workload, not a better assurance.

What it does not mean

Several common claims about the CLOUD Act are stronger than the law.

It is not a licence to browse. A request still needs valid legal process, and the provider can push back. Under 18 U.S.C. § 2703(h) a provider facing a request for a non-US customer's data "may file a motion to modify or quash the legal process" where disclosure would risk breaching the law of a country with a qualifying agreement with the US, and it has 14 days to do so. That right belongs to the provider, not to you, and whether it helps depends on the provider using it.

Nor does the UK-US agreement wall off UK data. The two governments signed a data access agreement in 2019, and it entered into force on 3 October 2022. Orders made under it may not target people or companies in the other country. But it only governs orders where a government chooses to invoke it, and its own text preserves everything else. This Agreement is without prejudice to and shall not affect other legal authorities, it says, including ordinary domestic law. A standard US warrant to a US provider is untouched by it.

You may also never be told. US law lets a court order a provider not to notify any other person of the existence of the warrant, subpoena, or court order where notice would endanger someone or jeopardise an investigation. Notice, when it comes at all, comes when the law allows it.

Is UK data residency enough for GDPR?

UK GDPR has no residency requirement, which surprises people. It restricts transfers of personal data out of the UK, and the ICO's guidance on cloud providers turns on the company rather than the building. The transfer status is not based on the geographical location of the servers where the information is stored, it says, but on where the contracted provider is established. Contract with a provider based outside the UK and you are making a restricted transfer, even with every server in London. Remote access counts as well, so a support team abroad that can see your systems is part of the picture.

Two further points matter for this post. Transfers of personal data to certified US organisations have been possible under the UK-US data bridge since 12 October 2023, so a US provider is not unlawful by default. And the EU GDPR article that refuses to recognise a foreign court's disclosure order on its own was omitted from the UK version at the end of 2020. Residency is neither required by UK GDPR nor sufficient against a foreign order. It is one good answer among several.

Where AI changes the picture

Everything above applies to files in storage. An AI tool adds a second provider and a second kind of data.

When your team uses an AI assistant, each prompt travels to a model, usually with documents retrieved from your own systems to help answer it, and the reply comes back. The model provider is a separate company, often headquartered somewhere other than your storage provider, and for the moment it holds all of that in readable form. A model has to read the text to work on it. Your CRM can sit in a UK region with your own encryption keys, and the paragraph your sales lead pasted into an assistant can still sit, readable, in a US model provider's logs.

That makes one lever matter more for AI than for storage, and it is the simplest of the three. A provider can only produce what it still has. A model service that keeps no prompts, outputs or logs beyond the time it needs to answer has nothing sitting in its possession, custody or control for an order to reach later. Retention settings are therefore a jurisdiction setting, and most businesses have never looked at theirs.

The three levers you actually hold

Who the provider answers to. Record the company you contract with, its ultimate parent and whether either operates in the US, next to the data location for every supplier, AI tools included. The NCSC's cloud principles go further than most contracts. Your service provider should present a complete list of countries where your data is stored and processed, and where the service is managed and supported from, which is a fair thing to ask for in writing.

Who holds the keys. If stored data is encrypted under keys the provider does not hold, what it controls is unreadable. The Department of Justice describes the Act as encryption neutral. It does not create any new authority for law enforcement to compel service providers to decrypt communications. Customer-held keys protect data at rest. They do not protect data a service is actively processing, which is exactly what an AI model does.

What the provider keeps. For storage, this is your data and you want it kept. For AI, it is prompts, retrieved documents, outputs and logs, and the right default is to keep as little as the work allows. Keeping what the business knows in a memory it owns, rather than in a model provider's history or a fine-tuned model, is what makes a short retention setting possible without losing anything.

None of these is about cost, and none requires leaving the large providers. Most workloads will be fine where they are once the three answers are written down. A few will not, and those are the ones a sovereign option is for.

What UK-sovereign options look like

The table runs from least to most control, and each row trades convenience for it. Few businesses need the bottom row for everything, but most have one or two workloads, such as anything touching a pending deal, a dispute or sensitive personal data, where it is worth asking whether the top row is really good enough. Model licences and running costs each have their own post in this series, because both deserve more than a table row.

Whichever row you choose, the arrangement only stays yours if you can leave it. The lock-in questions to ask before you sign cover the contract, and what you need to hold covers the exit. Jurisdiction is one more reason the exit has to be real.

Practical takeaways

1. Treat "our data is in London" as half an answer. It settles where the data is. Who controls it decides who can be made to hand it over.
2. Record the provider's ultimate parent and any US operations next to the data location, for every supplier including AI tools.
3. Hold your own keys for sensitive stored data, and remember they do not cover data a service is processing.
4. Check what your AI tools keep. Prompts, retrieved documents and logs are data, and a provider can only produce what it still has.
5. Pick the sovereign option per workload, not per business. Most work can stay where it is once the answers are written down.

Frequently asked questions

What is the US CLOUD Act?

The CLOUD Act is a US law passed in March 2018. The part that matters to UK businesses added a single sentence to the Stored Communications Act, now 18 U.S.C. § 2713, requiring providers subject to US jurisdiction to preserve or disclose customer data in their possession, custody or control, wherever that data is stored. It followed a court case in which Microsoft had refused to hand over emails held in Ireland, and it settled that dispute in the government's favour. It applies to legal process in criminal investigations, which still has to meet the usual US legal standards. US intelligence powers sit under separate law.

Does the CLOUD Act apply to data stored in the UK?

Yes, if the provider holding it is subject to US jurisdiction. The test is whether the provider controls the data, not which country the server is in, so a UK region of a US-headquartered cloud is within reach. A UK-headquartered provider can be reached too if it has operations in the US. In practice it is rare. Microsoft reported 3 non-US enterprise customers whose data stored outside the US went to US law enforcement in the second half of 2025, and AWS reported none in the first half of 2026. Rare is not the same as never, though, and no provider can promise never.

Is UK data residency enough for GDPR?

UK GDPR does not require residency at all, so the question is slightly the wrong way round. It restricts transfers of personal data outside the UK, and the ICO is clear that whether a transfer happens depends on where your contracted provider is established, not where its servers are. A provider based outside the UK means a restricted transfer even if every server is in London. Residency also does nothing about a foreign court order, and the UK version of GDPR no longer carries the EU article that dealt with one. Treat residency as one useful answer among several, not as compliance.

What does a UK-sovereign hosting option look like?

There is a range, and each step gives up something in exchange for control. The lightest is a US provider's UK region with your own encryption keys, which keeps stored data unreadable to the provider but not data being processed. Next is a UK-headquartered provider with no US operations, which removes the US route at the cost of a smaller choice of services and models. Furthest is an open model running on infrastructure you or a UK provider control, which brings the AI layer under UK law but leaves you running it. Most businesses need the strongest option for a few workloads, not for everything.

What should we ask an AI provider about jurisdiction?

Ask five things. Which company do we contract with, who is its ultimate parent, and does either have operations in the US? Who holds the keys to our stored data? What does the model service keep, meaning prompts, retrieved documents, outputs and logs, and for how long? From which countries is the service run and supported? And what does the provider do when it receives a foreign order for our data, including whether it challenges, and whether it tells us when it is allowed to? Specific answers are a good sign. A long silence on the last question usually means nobody has asked before.