CLOUD Act: Why Danish hosting matters more than ever
The US CLOUD Act is a law most Danish businesses have never heard of, yet it can potentially give US authorities access to their data. This post explains what the law means in practice and why hosting your data in Denmark with GITC makes a real difference.
What is the US CLOUD Act?
CLOUD Act stands for Clarifying Lawful Overseas Use of Data Act and became law in the US in March 2018. It allows US law enforcement authorities, including the FBI and Department of Justice, to demand data from US cloud providers.
The crucial, often overlooked point is this: the physical location of the data does not matter. Whether your business data is on a server in Frankfurt, Dublin or Amsterdam is irrelevant if the provider is a US company such as Amazon (AWS), Microsoft (Azure) or Google (Cloud).
In other words, choosing a major US cloud provider makes your data potentially accessible to US authorities even when it is physically stored in the EU.
The conflict with the GDPR
The GDPR requires an adequate level of protection before EU citizens' personal data can be transferred to or processed in countries outside the EU. In its landmark 2020 Schrems II ruling, the Court of Justice of the EU found that US surveillance laws, including the CLOUD Act, do not sufficiently protect European data.
This creates a direct legal conflict:
| Aspect | GDPR (EU law) | CLOUD Act (US law) |
|---|---|---|
| Who can demand access? | Only EU courts with strong justification | US authorities with lower requirements |
| Must you be informed? | Yes, as a general rule | No – the provider may be subject to a gag order |
| Does it apply globally? | No, limited to the EU | Yes, extraterritorial reach |
| Who is responsible? | The business acting as controller | The US cloud provider |
As a result, European businesses using US cloud services face a legal grey area that is difficult to navigate and can lead to GDPR fines even without actively doing anything wrong.
What does this mean for your business in practice?
Imagine your business uses Microsoft Azure with a data centre in Ireland. Your data is physically in the EU. But Microsoft is a US company, so the CLOUD Act applies globally. If US authorities request your data, Microsoft is obliged to provide it and may not have to inform you.
This is not a hypothetical risk. Since the CLOUD Act took effect, numerous documented cases have involved US authorities requesting European users' data through US cloud providers.
For businesses processing sensitive personal information, customer data, HR information, health records, contracts or trade secrets, this is a real and underestimated risk.
Schrems II and political uncertainty
In 2023, the EU and US agreed a new EU-U.S. Data Privacy Framework intended to resolve data transfer issues. But it is already under legal pressure, and many experts expect another lawsuit, a so-called "Schrems III", potentially invalidating it again.
Geopolitical uncertainty has also grown considerably in recent years. EU–US relations are less stable than they once were, and dependence on US cloud services is increasingly a strategic issue rather than just a technical one.
The solution: hosting in Denmark with GITC
Choosing GITC as your hosting provider eliminates this entire issue at once.
GITC is a 100% Danish company, CVR 45235289, with no US owners, subsidiaries or parent companies. We are not subject to the CLOUD Act. US authorities cannot request your data from us under this law.
All our servers are at Adeo Datacenter in Albertslund, a Danish-owned data centre with redundant power, cooling and round-the-clock monitoring. The network uses two independent upstreams: GlobalConnect 10G with DDoS protection and Cogent 10G as backup. Your data never leaves Danish jurisdiction.
In practical terms, this means:
- No CLOUD Act risk. We are not a US company, so the law simply does not apply to us.
- Full GDPR compliance from day one. No third-country transfers, no Standard Contractual Clauses and no Transfer Impact Assessments.
- The Danish Data Protection Agency is your supervisory authority. All disputes and enquiries are handled under Danish and European law.
- A simple data processing agreement. Both parties operate under the same laws, without legal complexity.
- Danish support in your time zone. If a data breach occurs, you must notify the Danish Data Protection Agency within 72 hours. Our Danish support is ready to help quickly and effectively.
A greener profile and reliable operations
Our data centre in Albertslund uses green electricity from wind and hydropower wherever possible and is working towards carbon-neutral electricity consumption. The data centre is ISAE 3402 Type 2 certified with redundant power, cooling and networking.
The uptime guarantee is 99.9% with full SLA coverage. Your data is protected legally and technically.
Trust as a competitive advantage
"Your data is in Denmark" is easy to understand and hard to argue against. It requires no legal explanation to customers, partners or your board.
With GDPR fines rising significantly and digital strategies increasingly focused on digital sovereignty, choosing a Danish hosting provider is more than a technical matter. It is a strategic decision signalling responsibility and trust.
Get started with Danish hosting today
GITC offers everything from simple web hosting and domains to Linux VPS, Windows VPS, Flex VPS and Private Cloud, all hosted in Denmark with Danish support and no commitment period.
View our plans and prices and get started in minutes.
Frequently asked questions about the CLOUD Act and Danish hosting
Does the CLOUD Act apply to all US companies?
Yes. The CLOUD Act applies to all companies incorporated or registered in the US, regardless of where they operate or store data. This includes Amazon, Microsoft, Google, Cloudflare and many other major cloud providers.
Is using US cloud services illegal in the EU?
Not necessarily, but it is legally complex. You must ensure an adequate transfer mechanism, such as Standard Contractual Clauses, and conduct a Transfer Impact Assessment. These mechanisms risk being invalidated by the Court of Justice of the EU, as happened to Privacy Shield in 2020.
What is the difference between hosting in the EU and Denmark?
EU hosting means your data is physically in an EU country, but the provider may still be a US company subject to the CLOUD Act. Hosting in Denmark with GITC means the provider is a Danish company outside the CLOUD Act's reach and your data falls under Danish and European jurisdiction.
What is Schrems II?
Schrems II is a 2020 Court of Justice of the EU ruling invalidating the EU–US Privacy Shield agreement. It found US surveillance laws did not sufficiently protect European data. Since then, personal data transfers to the US have become considerably more legally complex.
Does GITC offer a data processing agreement?
Yes. As a GDPR-compliant Danish hosting provider, we offer a data processing agreement (DPA) to all customers processing personal data. Contact us at [email protected] to receive one.