The US CLOUD Act: what it really means for Swiss companies

The CLOUD Act lets US authorities access data held by US cloud providers – even on servers in Switzerland. What Swiss data protection law says, and the alternatives.

The core message first: the US CLOUD Act obliges American cloud providers to hand over data to US authorities on demand – regardless of where the servers are located. A Microsoft, Google or Amazon data centre in Zurich or Geneva offers no protection, because what matters is the US company’s control over the data, not the location of the hard drive.

What exactly is the CLOUD Act?

The “Clarifying Lawful Overseas Use of Data Act” was passed by the US Congress in March 2018. It clarifies that US law-enforcement agencies can require providers of electronic communication and cloud services to hand over data that is “in the provider’s possession, custody or control” – explicitly including data stored outside the United States.

In practice this means:

All US providers are affected – Microsoft 365, Google Workspace, Dropbox, AWS, Salesforce – as well as their foreign subsidiaries.
A “Swiss region” of a US hyperscaler is not a legal safeguard, but primarily a latency and marketing argument.
The affected company may never find out, because disclosure orders can come with a gag provision.

Does using US clouds violate Swiss data protection law?

Not per se – but it creates legal uncertainty you can simply avoid. The revised Swiss Federal Act on Data Protection (in force since 1 September 2023) requires a legal basis for data exports abroad. For certified US companies, the Swiss Federal Council has recognised the Swiss–U.S. Data Privacy Framework as providing adequate protection since 15 September 2024. However, this recognition is politically fragile: the predecessor agreement, Privacy Shield, was invalidated by the European Court of Justice in July 2020 (“Schrems II”), and complaints against the current framework are already pending.

Anyone bound by professional secrecy – lawyers, doctors, fiduciaries – has an additional problem: professional secrecy under Art. 321 of the Swiss Criminal Code knows no exemption for “the cloud provider was compelled by authorities”.

What alternatives do Swiss companies have?

The most robust answer is to take the US provider out of the equation. Open-source software makes that possible without giving up convenience:

US service	Open-source alternative	Data location
Dropbox / OneDrive	Nextcloud	Switzerland
Microsoft Office Online	Collabora Online	Switzerland
1Password / LastPass	Vaultwarden	Switzerland
DocuSign	Documenso	Switzerland
Google Analytics	Matomo	Switzerland

In words: for file storage, office suites, passwords, signatures and web analytics, mature open-source alternatives exist that can be operated entirely in Switzerland – by a provider that is subject neither to the CLOUD Act nor to a foreign parent company.

Isn’t a Swiss data centre of a US provider enough?

No. We hear this question often, so once more, clearly: the CLOUD Act attaches to control over the data, not to its location. As long as a US company (or its subsidiary) operates the service, the governmental access path remains. Genuine digital sovereignty only arises when both the operator and the infrastructure are Swiss – which is exactly how we run managed open-source hosting at OpenHosting: a Swiss company, Swiss data centres, open source code and no dependency on US corporations.

What should you do now, concretely?

Take inventory: which personal data and trade secrets are currently held by US services?
Prioritise critical data: customer files, HR data, patient and client records first.
Test the alternatives: most open-source tools can be introduced productively within days – our app catalogue lists more than 1,000 options.
Plan the migration: switch step by step, not everything at once – our Nextcloud migration article shows what this looks like for file storage.