"Our data is hosted in Europe." That sentence reassures a lot of people and does not guarantee what they think it does. What determines the applicable law is not where the hard drives sit, but the entity that controls them. A European subsidiary of an American group falls under American law on this specific point.
This morning we reported on a company moving its headquarters to Germany for this reason. Here is the mechanism.
What the law provides
The Clarifying Lawful Overseas Use of Data Act, passed in 2018, clarified a point that had been debated: a company subject to American jurisdiction can be required to produce data it holds or controls, regardless of where it is stored.
The original intention was practical. Before this text, a judicial request could be blocked by a localisation argument, which complicated investigations in a world where data circulates.
The side effect is that physical location ceases to be a protection. A server in Frankfurt operated by a subsidiary of an American group remains in scope.
The tension with European law
This is where the situation becomes uncomfortable for a European company.
The European data regulation strictly governs transfers to third countries and imposes precise conditions. A request based on a foreign law, without going through the judicial cooperation mechanisms provided for, does not in itself constitute a sufficient legal basis under that framework.
A provider subject to both legal orders can therefore find itself in a position where satisfying one amounts to breaching the other. This conflict is real, documented, and has no general solution — which explains the caution of legal departments.
Who controls the contracting entity? Not where the servers are: which company signs, and which group it belongs to.
Who holds the encryption keys? If the provider cannot technically decrypt your data, a production order does not get it very far. This is the most solid protection.
What does the contract provide for in the event of a request? Are you notified? Can it be contested? Some commitments provide for notification and systematic objection, others do not.
What this changes in concrete choices
This mechanism explains several movements we have documented without always connecting them.
The shift towards in-house hosting. We reported that half of large American companies favour open models hosted on their own premises. A model running on your machines does not fall under any foreign jurisdiction, because no third party holds your data.
The value of a European provider. This is not economic patriotism: it is the elimination of an identified legal risk.
End-to-end encryption. When it is genuinely implemented, it makes the question largely theoretical. It is also why homomorphic encryption attracts so much interest: it would allow data to be processed without ever being decrypted.
Key takeaways
The subject looks legal, and it is highly concrete: every day it decides purchases that do not happen.
The practical rule comes down to one sentence: ask who is in control, not where it is stored. Location is a marketing detail; jurisdiction is a contractual one.
And for anything genuinely sensitive, the conclusion remains the one we set out in every article on this topic: what does not leave your premises falls under no foreign law, because there is nothing to produce.