The US CLOUD Act and digital sovereignty: cloud choices for European universities (2026)

Many European universities run email, documents and research storage on US cloud platforms, and staff increasingly ask whether US authorities can reach that data. This guide separates the legal facts from the political debate: what the CLOUD Act and FISA Section 702 say, how EU law answers them, what EU data boundaries and sovereign clouds do and do not change, what universities and research networks in several countries are doing, and how to choose hosting by data type with a realistic exit plan.

Published 9 October 2026 · Sources checked 9 October 2026

Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português

This is a political topic as well as a legal one. In this guide, statements of law and documented facts carry a source. Our own reading of what they mean for universities is marked Validemic's analysis. Positions taken by universities, staff groups and authorities are reported as their positions, not as settled law.

1. What does the CLOUD Act actually say?

The CLOUD Act is a 2018 US law that requires US-regulated communication and cloud providers to disclose data they control when served with valid US legal process, even if the data is stored abroad. It is a criminal law enforcement tool, and it also created a route for bilateral agreements with foreign governments.

The core rule is in 18 U.S.C. § 2713, added on 23 March 2018. A provider of electronic communication service or remote computing service must comply with the obligations in the Stored Communications Act to preserve, back up or disclose communications and customer records that are in its "possession, custody, or control", "regardless of whether such communication, record, or other information is located within or outside of the United States" [1].

Three points are often lost in the debate:

• It is not a new surveillance power. It extends existing law enforcement tools under the Stored Communications Act to data stored abroad. The Data Privacy Framework decision notes that stored content generally requires a judicial warrant based on probable cause (recital 96) [9].
• There is a limited route to object. Under 18 U.S.C. § 2703(h), a provider may move to quash or modify an order where the customer is not a US person and does not reside in the US, and disclosure would create a material risk of violating the laws of a "qualifying foreign government". That term only covers countries with an executive agreement under the Act that offer comparable rights to providers [2].
• Agreements exist with some countries, not with the EU. The US Department of Justice lists agreements with the United Kingdom (signed 3 October 2019) and Australia (15 December 2021). For the EU it lists a 2019 joint statement on negotiations and a 2023 announcement that negotiations would resume [3]. We found no concluded EU-US agreement on 9 October 2026.

Validemic's analysis The test that matters for a university is control, not location. If a provider subject to US jurisdiction can access the data in a usable form, a US order addressed to that provider is legally possible, whatever the server location. How often this happens in practice for university data is a separate question that public sources cannot fully answer.

2. FISA 702, EO 12333 and Schrems II

The main concern behind the Schrems II judgment was US intelligence surveillance, not the CLOUD Act. Section 702 of the Foreign Intelligence Surveillance Act (50 U.S.C. § 1881a) allows targeting of non-US persons abroad with compelled help from US providers. Executive Order 12333 governs other intelligence activities, including collection outside the United States [5].

In Schrems II (C-311/18, 16 July 2020) the Court of Justice held that "neither Section 702 of the FISA, nor E.O. 12333" provided the minimum safeguards required by the principle of proportionality (para. 184). It also found that the Privacy Shield ombudsperson did not give individuals a remedy equivalent to Article 47 of the Charter (para. 197), and declared the Privacy Shield decision invalid [5].

The US response was Executive Order 14086 of 7 October 2022, which strengthened safeguards for signals intelligence and, with an Attorney General regulation, set up a redress mechanism including the Data Protection Review Court (DPRC). The Commission relied on it when adopting the Data Privacy Framework adequacy decision on 10 July 2023 [8] [9].

Section 702 in 2026

Section 702 was last reauthorised in April 2024 with a sunset in April 2026. After short-term extensions, a further extension failed in the House and the statute expired on 12 June 2026. The Associated Press reported that a March 2026 opinion of the Foreign Intelligence Surveillance Court "certified the program's renewal for another 12 months", so collection was not expected to stop immediately [6]. The Brennan Center, a US policy institute, says that Section 702 surveillance will continue until March 2027 even if the statute lapses [7].

Pending: on 9 October 2026 we found no new Section 702 reauthorisation in force. Whether Congress renews it, and with what changes, is relevant to the Commission's monitoring of the Data Privacy Framework. Recheck before relying on this paragraph.

3. How does EU law answer foreign access?

EU law does not accept a foreign court order or authority decision, on its own, as a lawful basis to hand over personal data. Article 48 GDPR says such orders can only be recognised or enforced if based on an international agreement such as a mutual legal assistance treaty, without prejudice to the other Chapter V grounds [10].

In their joint response to the European Parliament's LIBE Committee of 10 July 2019, the EDPB and the EDPS quoted the Commission's view that "Article 48 makes clear that a foreign court order does not, as such, make a transfer lawful under GDPR". They concluded that, without an international agreement or another legal basis, "service providers subject to EU law cannot legally base the disclosure and transfer of personal data to the US on such requests" [11]. They also found most Article 6 and Article 49 grounds unsuitable for routine CLOUD Act requests.

Other EU rules point the same way:

• GDPR Art. 28(3)(a). A processor may only process on documented instructions from the controller, including on transfers, unless required to do so by Union or Member State law. A US order is not Union or Member State law [4].
• Standard contractual clauses, Clause 15. Where SCCs apply, the importer must notify the exporter promptly of a legally binding request from a public authority, use best efforts to obtain a waiver if it is prohibited from notifying, and keep records of requests (Clause 15.1) [12].
• Data Act Art. 32. For non-personal data, such as unpublished research results or institutional data, cloud providers must take "all adequate technical, organisational and legal measures, including contracts" to prevent third-country governmental access that would conflict with EU or national law. Foreign orders are recognised only on the basis of an international agreement, or in the absence of one only under conditions set out in Art. 32(3) [13].

Validemic's analysis These rules create a conflict of laws, not a shield. They make disclosure unlawful from the EU side and give the customer a right to be told, but they cannot stop a provider from complying with its home law. This is why some authorities focus on technical control, such as who holds the encryption keys, rather than on contract terms alone.

4. Where the Data Privacy Framework stands on 9 October 2026

The EU-US Data Privacy Framework (DPF) adequacy decision, Implementing Decision (EU) 2023/1795, is in force and covers transfers to US organisations on the DPF List. It addresses intelligence access through EO 14086 and the DPRC, and it describes law enforcement access under the Stored Communications Act, the law that the CLOUD Act amended [9].

• General Court, 3 September 2025. In Latombe v Commission (T-553/23) the General Court dismissed the action. It found the DPRC sufficiently independent and held that Schrems II requires, at a minimum, ex post judicial review of bulk collection, which US law provides through the DPRC. It also noted that the Commission must continuously monitor the US legal framework and may suspend, amend or repeal the decision [14].
• Appeal, C-703/25 P. Mr Latombe appealed on 31 October 2025 [15]. The appeal is pending. Our Data Privacy Framework guide tracks the procedure, including Microsoft's admission as an intervener in June 2026.
• EDPB. On 31 July 2026 the EDPB wrote to the Commission about the US Supreme Court judgment Trump v. Slaughter, which concerns the independence of US agencies such as the FTC [16].

Validemic's analysis The DPF answers the transfer question for US organisations on the list. It does not answer the sovereignty question, which is about dependency, continuity and control. A university can have a lawful transfer basis and still decide that some data should not depend on a single non-EU provider. For the transfer side, see our TIA template and the transfer mechanism tool.

5. Data residency is not data sovereignty

Data residency means data is stored and processed in a chosen region, such as the EU. Data sovereignty asks which legal systems and which organisations can control, access or switch off the data and the service. A service can meet residency requirements while the operator remains subject to non-EU law. The two need separate questions in a vendor review.

The EDPB's Recommendations 01/2020 describe the limit of technical measures clearly. For cloud services that need access to data in the clear (Use Case 6), the EDPB said it was "incapable of envisioning an effective technical measure" to prevent disproportionate access by public authorities, given the state of the art [17]. That is why most productivity suites, which must read content to index, search and run AI features, are hard to protect with encryption alone.

6. What the large providers offer

The descriptions below come from each vendor's own pages. We do not assess whether they meet any legal standard; read the contract terms for your plan.

Microsoft: EU Data Boundary and sovereign offerings

Microsoft describes the EU Data Boundary as a boundary within which it commits to store and process Customer Data and personal data for its enterprise online services, including Azure, Dynamics 365, Power Platform and Microsoft 365. The page states that these commitments are "subject to limited circumstances" where data continues to be transferred outside the boundary, and documents those transfers separately. The boundary covers EU and EFTA countries. For Microsoft 365, tenants with an EU or EFTA sign-up location are in scope, but tenants with Multi-Geo Capabilities are not [18].

In April 2025 Microsoft published five "European digital commitments", including a pledge to challenge any government order to suspend its European cloud operations and oversight of European data centres by a board of European nationals [19]. In June 2025 it announced a Sovereign Public Cloud and Sovereign Private Cloud (both in preview at the time), Microsoft 365 Local, "Data Guardian" (remote access limited to European-resident staff), external key management, and national partner clouds such as Bleu in France and Delos Cloud in Germany [20].

A university example shows why residency settings need monitoring. SURF's May 2026 update to its Microsoft 365 Copilot DPIA records that Microsoft introduced "flex routing" in March 2026, enabling data transfers outside the EU Data Boundary for new tenants. SURF verified that existing Dutch education tenants were not changed, and added the issue as a new low risk [21]. See also our fact sheets on Microsoft 365 and Microsoft Copilot.

AWS European Sovereign Cloud

AWS announced general availability of the AWS European Sovereign Cloud on 15 January 2026, with its first region in Brandenburg, Germany. AWS says it is physically and logically separate from other AWS regions, operated by EU residents through a new parent company and German subsidiaries led by EU citizens, with "zero operational control outside of EU borders". It plans sovereign Local Zones in Belgium, the Netherlands and Portugal [22].

Google Cloud sovereign offerings

Google lists three main options. Google Cloud Data Boundary offers residency and access controls in the public cloud, including customer-managed and externally stored keys. Google Cloud Dedicated runs on isolated infrastructure operated by a local partner; in France it is operated by S3NS, a standalone French entity with Thales, which Google says is designed to meet SecNumCloud requirements. Google Distributed Cloud runs on premises in connected or air-gapped mode [23]. See our fact sheet on Google Workspace.

Validemic's analysis Data boundaries mainly change location and support access. Separately operated clouds try to change who controls the operator. Customer-held keys and on-premises deployments change who can read the data. When a vendor says "sovereign", ask which of these it means, for which services and on which plan.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

7. Certification: EUCS and SecNumCloud

There is no adopted EU-wide certification of "sovereign" cloud services on 9 October 2026. The EU cloud cybersecurity scheme (EUCS) is still a candidate scheme. France's SecNumCloud qualification is the most established national label that explicitly covers protection against non-EU law.

• EUCS. The Commission's page on the Cybersecurity Certification Framework, last updated 9 September 2026, lists the "European cybersecurity certification scheme for cloud services" among the candidate schemes ENISA was asked to prepare, and names the Common Criteria scheme (EUCC) as the first scheme adopted [24]. Earlier drafts that would have added sovereignty requirements were the subject of long debate among Member States; any final scheme may differ.
• SecNumCloud (France). ANSSI says that SecNumCloud-qualified offers aim to protect sensitive data "face à la menace cybercriminelle et à l'application de lois extraterritoriales" and publishes the list of qualified services [25]. The CNIL's guidance for higher education, dated 24 August 2026, gives SecNumCloud qualification as an example of a way to ensure a provider is subject exclusively to European law [26].

8. What governments and the public sector are doing

Public bodies in several countries are reducing dependence on a small number of non-EU providers. Most efforts are gradual, and their stated reasons include continuity and bargaining power as well as data protection.

• France. In a parliamentary answer published on 15 November 2022, the education ministry said the state digital agency had found in 2021 that Office 365 did not conform to the "cloud au centre" doctrine, that the CNIL had advised higher education institutions to use providers subject exclusively to European law, and that rectors had been asked to stop further Microsoft and Google deployments in schools [27]. That answer predates the 2023 Data Privacy Framework.
• Germany. A 2026 case catalogue from the Danish Agency for Digital Government describes Schleswig-Holstein's move, begun in 2012, to LibreOffice, Linux, Nextcloud and Open-Xchange, aiming to be free of all but a few critical Microsoft products by 2029; 24,000 of 30,000 state employees now use the new workplace [28]. ZenDiS, a federally funded company, develops openDesk, an open-source office suite for public administration [29].
• Denmark. The Agency for Digital Government says the 2026 Finance Act sets aside DKK 80 million for 2026 to 2029 for an action plan on digital sovereignty [30]. Its case catalogue describes Aarhus Municipality replacing Microsoft Azure with the German provider Hetzner for about 60 solutions in one department, and a Copenhagen Municipality analysis of around 150 critical systems reported to the city council in December 2025 [28].
• Netherlands. In September 2026 the Dutch government's ICT review board (AcICT) published guidance on cloud use for public bodies. Its first recommendation is to weigh strategic dependencies carefully, including lock-in and exit options [31].
• Switzerland. The cantonal data protection authorities (privatim) adopted a resolution in November 2025. It considers outsourcing especially sensitive or legally secret personal data to large international SaaS services "in most cases (such as M365)" impermissible, unless the public body encrypts the data itself and the provider has no access to the key [32].
• Sweden. eSam, the cooperation body for Swedish public agencies, wrote in September 2025 that the EU-US adequacy decision applies until it is withdrawn or annulled, but does not necessarily resolve questions of foreign access under extraterritorial law [33].

9. What universities and research networks are doing

European universities are taking three main paths: assessing the large US suites in depth, building or buying shared European alternatives through their national research and education networks (NRENs), and, in the Netherlands, adopting a sector-wide plan for digital autonomy.

The Netherlands: from open letters to a sector plan

• Staff letters. In March 2025 two Utrecht University professors wrote to their board that "The fact that the data is stored on European servers offers no (legal) protection", citing the CLOUD Act [34]. Similar letters followed at Radboud University (March 2025) [35] and the University of Groningen (April 2025) [36]. In a December 2025 think paper, the Utrecht authors wrote that the large providers "are subject to American jurisdiction (in particular the Cloud Act)" [37].
• Sector plan. In May 2026 Universities of the Netherlands (UNL) announced that the universities, central government and SURF will work together to strengthen digital autonomy, citing risks to knowledge security, privacy, continuity and academic values. A committee will propose joint procurement terms, alternatives and international cooperation, starting with a baseline risk assessment [38]. TU Eindhoven's news site reported that universities and the State Secretary signed a letter of intent in June 2026 [39].
• SURF. SURF's cloud sourcing strategy (2024) includes data sovereignty as one of nine themes and says control over data is never transferred to the supplier [40]. In November 2025 SURF announced it would offer Nextcloud to all member institutions from January 2026, noting that "our independence and public values are coming under increasing pressure" [41]. Its DPIAs on Microsoft 365 Copilot are a model of how a sector body can assess one supplier on behalf of many [21].
• Realistic timelines. About 75 researchers from five Dutch universities had tested Nextcloud since early 2025, Utrecht's university newspaper reported [42]. The University of Twente's IT director told its newspaper that the university cannot do this alone and described a sovereign workplace project with Linux and LibreOffice [43].

Nordic countries

• Sweden. Sunet Drive is a storage and file-sharing service built on Nextcloud and Sunet's private S3 storage, located on Swedish servers. Sunet says the organisation "har full kontroll över allt lagrat data" (has full control over all stored data) [44]. Stockholm University offers it to researchers [45].
• Finland. CSC, the Finnish IT centre for science, runs sensitive data services including ePouta, described as "a secure cloud computing environment designed to process sensitive data" [46].
• Norway. NREC, run by the Universities of Bergen and Oslo with national partners, provides infrastructure-as-a-service from data centres in Bergen and Oslo for the higher education sector [47].

Germany, Switzerland and France

• sciebo (North Rhine-Westphalia). When it launched in 2015, the University of Münster said the participating universities run sciebo themselves, with data processed in Münster, Bonn and Duisburg-Essen [48]. Its current site calls it "a non-commercial cloud storage by universities for universities" [49].
• bwSync&Share (Baden-Württemberg). Operated by the Karlsruhe Institute of Technology since 1 January 2014 on Nextcloud, and open to universities in the state and, via DFN-Cloud, to other DFN members [50].
• Switzerland. Switch Drive is hosted in Switch's data centres in Switzerland; Switch states that "All IT resources and usage data are located in Switch data centres" [51].
• France. RENATER presents its collaboration services as an alternative to free online services, with a commitment to "garantir le stockage de vos données en France" [52].

Pan-European procurement: GÉANT OCRE

GÉANT's Open Clouds for Research Environments (OCRE) framework lets NRENs offer commercial cloud services to their members on pre-negotiated terms. Luxembourg's NREN Restena reported that the OCRE 2024 framework took effect on 3 February 2025, covering IaaS, PaaS and SaaS, and that in Luxembourg seven platforms remain available, a mix of US and European providers [53]. Ask your NREN which providers are available in your country.

Validemic's analysis Across countries, universities are not leaving US suites overnight. They classify data, keep the most sensitive research data in NREN or national services, build shared alternatives for file sharing, and use sector bodies to negotiate and assess. See our guide to research data cloud storage and the Nextcloud fact sheet.

10. How to assess the risk

A CLOUD Act and sovereignty assessment fits into the normal GDPR process. Combine the transfer assessment for any data leaving the EEA with a broader dependency assessment covering foreign legal access, continuity and exit. Do it per service and per data type, not once for "the cloud".

1. Map the service. Contracting entity, operating entities, storage and processing locations, subprocessors and support locations. Use the subprocessor list, not marketing pages.
2. Classify the data. Use your institution's classification and flag special category data, legally secret data, export-controlled research and data under partner confidentiality terms.
3. Identify transfers and the transfer tool. Remote access from outside the EEA counts as a transfer [17]. For US recipients, check the DPF List entry; otherwise, use SCCs with a transfer impact assessment. Our transfer mechanism tool and TIA template cover this step.
4. Assess foreign legal access separately. Ask whether the operator is subject to US (or other non-EU) jurisdiction, whether it can access content in the clear, and what it commits to do on receiving a request: notify you, challenge it, disclose only the minimum, and publish transparency data (compare SCC Clause 15) [12].
5. Assess technical controls. Who holds the keys? Is client-side or end-to-end encryption available for the data that needs it? Which features stop working when you use it?
6. Assess dependency and continuity. What would happen if the service became unavailable, much more expensive, or legally unusable for some data? How long would migration take?
7. Decide and record. Record the residual risk, the conditions of use (for example "no special category data"), and who accepted it. Update the DPIA where needed; see our DPIA template.
8. Monitor. Watch for changes in hosting, subprocessors, default settings and US law (Section 702, the C-703/25 P appeal, the Commission's DPF review). The SURF flex routing example shows that defaults can change.

Where a sector body has already assessed the service (for example SURF's DPIAs), start from that and check that your configuration matches its assumptions. For the wider process, see vendor assessment for universities and our NIS2 guide.

11. Decision table: hosting by data type

The table below is Validemic's analysis, not a legal requirement. It shows a common pattern that matches the positions of the sources above. Your national law, research contracts and institutional classification take priority.

AI features need extra attention, because they often add processing locations and subprocessors. Our guide on Nordic university AI services shows how some institutions host AI themselves for this reason.

12. Exit strategies

An exit strategy is a documented, tested plan for moving a service and its data to another provider or in house within a set time and budget. It is the most practical sovereignty measure, because it limits the damage of any future change in law, price or policy. The EU Data Act now gives cloud customers enforceable switching rights.

What the Data Act requires

Chapter VI of Regulation (EU) 2023/2854 has applied since 12 September 2025 [13]. Providers of data processing services must remove obstacles to switching (Art. 23), and the contract must include, among other things (Art. 25(2)):

• a maximum notice period for starting the switch of no more than two months;
• a mandatory maximum transitional period of 30 calendar days, during which the provider must assist, maintain continuity and keep the data secure;
• an obligation to support the customer's exit strategy;
• an exhaustive specification of the data and digital assets that can be ported;
• a data retrieval period of at least 30 calendar days after the transitional period;
• full erasure of exportable data after the retrieval period.

On charges, providers could only impose reduced switching charges, not exceeding direct costs, from 11 January 2024. From 12 January 2027 they may not impose any switching charges (Art. 29). Art. 31 exempts some custom-built services and test versions from parts of these rules. See our Data Act explainer.

Building the plan

1. Inventory. Services, data volumes, integrations (single sign-on, learning platform, research systems) and dependent users.
2. Formats. Prefer open formats and check that exports include metadata, permissions and version history.
3. Identity. Keep identity management under institutional or federated control, so that a change of provider does not mean a change of every user account.
4. Alternatives. Identify at least one realistic alternative per critical service, often through your NREN or a national shared service.
5. Test. Run a partial export and import each year for a sample department. An untested exit plan is a hope, not a plan.
6. Budget and time. Record the expected cost and duration of migration. The Danish case catalogue shows that even a limited move (about 60 solutions in one Aarhus department) took about six months [28].

13. Procurement clauses to ask for

Contract terms cannot change which laws apply to a provider, but they can give the university information, time and options. Use the clauses below in tenders and renewals, adapted to your national procurement rules. Our vendor questionnaire builder can turn them into questions.

Where your sector body negotiates centrally (SURF, Sikt, Sunet, CSC, Jisc, DFN or GÉANT through OCRE), check which of these terms are already in the framework agreement before negotiating alone. For the Article 28 terms themselves, our DPA checker maps a draft agreement point by point, and subprocessor alerts can help you notice changes after signing.

14. Checklist

Sources

1. 18 U.S.C. § 2713, Required preservation and disclosure of communications and records, Legal Information Institute (retrieved 9 October 2026).
2. 18 U.S.C. § 2703, subsection (h), comity analysis, Legal Information Institute (retrieved 9 October 2026).
3. US Department of Justice: CLOUD Act Resources (retrieved 9 October 2026).
4. Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 44 and 48 (retrieved 9 October 2026).
5. Court of Justice, judgment of 16 July 2020, Facebook Ireland and Schrems, C-311/18, paras 184, 197 and 201, read via the EU Publications Office (retrieved 9 October 2026).
6. Associated Press: A key U.S. government surveillance program is set to expire. A look at what that means, 12 June 2026 (retrieved 9 October 2026).
7. Brennan Center for Justice: Section 702 of FISA, 2026 resource page, updated 17 September 2026 (retrieved 9 October 2026).
8. Court of Justice of the EU, Press release No 106/25 on Case T-553/23, describing EO 14086 of 7 October 2022 and the DPRC (retrieved 9 October 2026).
9. Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), recitals 96 to 97, read via the EU Publications Office (retrieved 9 October 2026).
10. GDPR Article 48, Transfers or disclosures not authorised by Union law (retrieved 9 October 2026).
11. EDPB-EDPS Joint Response to the LIBE Committee on the impact of the US Cloud Act, annex dated 10 July 2019 (retrieved 9 October 2026).
12. Commission Implementing Decision (EU) 2021/914 (standard contractual clauses), Clause 15 (retrieved 9 October 2026).
13. Regulation (EU) 2023/2854 (Data Act), Articles 23, 25, 29, 31, 32 and 50, read via the EU Publications Office (retrieved 9 October 2026).
14. General Court, Latombe v Commission, T-553/23, press release of 3 September 2025 (retrieved 9 October 2026).
15. Appeal brought on 31 October 2025 by Philippe Latombe, Case C-703/25 P, OJ C/2025/6610 (retrieved 9 October 2026).
16. EDPB Letter to the European Commission on US Supreme Court judgment Trump v. Slaughter, 31 July 2026 (retrieved 9 October 2026).
17. EDPB Recommendations 01/2020 on supplementary measures, version 2.0, para. 13 and Use Case 6 (retrieved 9 October 2026).
18. Microsoft Learn: What is the EU Data Boundary? (retrieved 9 October 2026).
19. Microsoft: Microsoft announces new European digital commitments, Brad Smith, 30 April 2025 (retrieved 9 October 2026).
20. Microsoft: Announcing comprehensive sovereign solutions empowering European organizations, 16 June 2025 (retrieved 9 October 2026).
21. SURF: Privacy risks Microsoft 365 Copilot remain 'orange' despite improvements, 27 May 2026 (retrieved 9 October 2026).
22. AWS: AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe, 15 January 2026 (retrieved 9 October 2026).
23. Google Cloud: Sovereign Cloud (retrieved 9 October 2026).
24. European Commission: EU Cybersecurity Certification Framework, last updated 9 September 2026 (retrieved 9 October 2026).
25. ANSSI: SecNumCloud pour les fournisseurs de services cloud (retrieved 9 October 2026).
26. CNIL: Enseignement supérieur, les règles et bonnes pratiques pour utiliser des outils collaboratifs en ligne, 24 August 2026 (retrieved 9 October 2026).
27. Assemblée nationale, written question No. 971 and ministerial answer, answer published 15 November 2022 (retrieved 9 October 2026).
28. Digitaliseringsstyrelsen: Digital suverænitet, casekatalog (prepared by PA Consulting), January 2026, cases 3, 11 and 13 (retrieved 9 October 2026).
29. openDesk (ZenDiS) (retrieved 9 October 2026).
30. Digitaliseringsstyrelsen: Digital suverænitet (retrieved 9 October 2026).
31. Digitale Overheid: Cloud, including the AcICT guidance on cloud use, 8 September 2026 (retrieved 9 October 2026).
32. privatim: Resolution on international cloud solutions and press release, 24 November 2025 (retrieved 9 October 2026).
33. eSam: Uppdatering kring adekvansbeslutet i en turbulent tid, 26 September 2025 (retrieved 9 October 2026).
34. Utrecht University: Open letter to the Executive Board calling for a transformation to digital autonomy, 25 March 2025 (retrieved 9 October 2026).
35. Radboud University staff: Open letter on dependence on Big Tech, 10 March 2025 (retrieved 9 October 2026).
36. University of Groningen: Open letter to the Executive Board to end dependence on Big Tech, 10 April 2025 (retrieved 9 October 2026).
37. Utrecht University, IOS Think Paper 7: Towards a collective digital autonomy for Dutch universities, December 2025 (retrieved 9 October 2026).
38. Universiteiten van Nederland: Universiteiten lanceren plan om digitaal autonomer te worden, 6 May 2026 (retrieved 9 October 2026).
39. Cursor (TU Eindhoven): Universities and government join forces on digital autonomy, 26 June 2026 (retrieved 9 October 2026).
40. SURF: Cloud sourcing strategie, 2024 (retrieved 9 October 2026).
41. SURF: Education and research move forward with Nextcloud, 24 November 2025 (retrieved 9 October 2026).
42. DUB (Utrecht University): Can Dutch universities do without Microsoft?, 24 November 2025 (retrieved 9 October 2026).
43. U-Today (University of Twente): Breaking free from big tech? UT can't do it alone, 9 December 2025 (retrieved 9 October 2026).
44. Sunet: Sunet Drive (retrieved 9 October 2026).
45. Stockholm University: Sunet Drive (Nextcloud), updated 24 November 2025 (retrieved 9 October 2026).
46. CSC: Sensitive data services (retrieved 9 October 2026).
47. NREC: Norwegian Research and Education Cloud (retrieved 9 October 2026).
48. University of Münster: press release on the launch of sciebo, 28 January 2015 (retrieved 9 October 2026).
49. hochschulcloud.nrw: sciebo (retrieved 9 October 2026).
50. Karlsruhe Institute of Technology: bwSync&Share (retrieved 9 October 2026).
51. Switch: Switch Drive (retrieved 9 October 2026).
52. RENATER: Services (retrieved 9 October 2026).
53. Restena: Cloud suppliers and opportunities for 2025-2029 (GÉANT OCRE 2024), 14 February 2025 (retrieved 9 October 2026).

About this page

Sources checked on 9 October 2026. We read the legal texts (US Code via the Legal Information Institute; EU acts in the Official Journal versions published by the EU Publications Office), court documents, EDPB, Commission and national authority pages, vendor pages and the university and research network pages listed above. Vendor descriptions are the vendors' own; we did not test the services. Where we give our own interpretation, it is labelled as Validemic's analysis. This page is general information, not legal advice. US surveillance law, the Data Privacy Framework appeal and the EU cloud certification scheme are all subject to change, and we will update this page when they do. If you spot an error or an outdated point, please contact us and we will correct it.