The EU Data Act does not just govern how data is shared among commercial parties within Europe. It also establishes rules designed to prevent foreign governments — including the US government — from obtaining non-personal data held in the EU through legal demands that would conflict with EU law. For US companies operating cloud infrastructure, data processing platforms, or technology services that store or process data on behalf of EU customers, these rules create specific legal obligations and require a carefully structured compliance response.

This page covers Chapter IX of the Data Act — its framework for preventing unlawful international transfers, how it interacts with US legal process, what it means for data residency decisions, and what US companies must do when they receive a government request for EU-held data.

The Core Obligation: Preventing Unlawful Third-Country Access

Chapter IX of the EU Data Act imposes an obligation on cloud service providers and data processing service providers to take technical, legal, and organizational measures to prevent third-country governments from accessing non-personal data held in the EU where that access would be unlawful under EU law. The provision targets a specific risk: that a government outside the EU — using its own domestic legal authority — could compel a company to hand over data stored in Europe in a way that would not be permissible under EU rules.

This is not a purely hypothetical concern. US government agencies, including law enforcement, national security agencies, and regulatory bodies, have broad legal authority under US law to compel US-based companies to produce data — including data stored abroad. The Foreign Intelligence Surveillance Act (FISA), the USA PATRIOT Act, national security letters, grand jury subpoenas, and various regulatory disclosure requirements have all been used to reach data held by US companies in foreign jurisdictions. From an EU perspective, these demands can conflict with EU law and with the rights of data holders and users who entrusted their data to cloud services operating in Europe.

The Data Act’s Chapter IX is designed to give EU data holders legal protection against this risk. The obligation is placed on the service provider — not on the data holder — because the service provider is the party that has both the technical custody of the data and the legal relationship with the foreign government making the demand.

The Challenge Obligation: What Providers Must Do When Demands Arrive

Chapter IX does not simply tell providers to ignore foreign government requests. It establishes a structured process with specific obligations. When a provider receives a request from a third-country government for non-personal data held in the EU, the provider must evaluate whether the request has a valid legal basis under EU law and must challenge requests that do not.

The challenge obligation is the most operationally significant aspect of Chapter IX. A US company that receives a US government demand for data held in EU data centers cannot simply comply automatically. It must first assess whether that demand is compatible with EU law. If it is not — or if there is no EU law basis that would authorize the transfer — the company must use all available legal remedies in the requesting country to challenge the demand before complying. This means filing a motion to quash, asserting applicable privileges or immunities, or otherwise contesting the legal validity of the demand in a US court or administrative proceeding.

The obligation to challenge is not absolute. If the provider has exhausted all available legal remedies and the demand remains in force — issued by a court or agency with final authority, following proper procedure, and enforceable under the requesting country’s law — then providing the data may be lawful even if no EU legal basis exists. The key is that the challenge process must be genuinely pursued, not perfunctory. Providers cannot use the technical existence of appeal mechanisms as a fig leaf while actually facilitating easy access.

The Data Act also requires that providers notify the EU data holder of the government request before complying, to the extent permitted by law. US government requests often include confidentiality requirements or gag orders that prohibit disclosure. In such cases, the provider must inform the requesting authority of the EU notification obligation and request permission to notify, or seek judicial relief from the confidentiality requirement. Where disclosure is legally prohibited and no relief is available, the provider must document the restriction and the steps taken.

What “Conflict With EU Law” Means in Practice

The phrase “conflict with EU law” is central to how Chapter IX operates, and understanding it requires some legal context. EU law does not recognize unlimited foreign government authority to compel disclosure of EU-held data. Several categories of EU law can create such a conflict.

First, the GDPR. If the non-personal data has been derived from or is closely associated with personal data about EU residents, transferring it in response to a foreign government demand may implicate GDPR Chapter V restrictions on international transfers of personal data. A demand that purports to be for non-personal data but would effectively expose personal data about EU data subjects creates a GDPR conflict.

Second, EU trade secret and intellectual property law. If the requested data constitutes a trade secret under the EU Trade Secrets Directive, transferring it to a foreign government — particularly one whose legal process may then make it available to competitors or foreign state actors — could conflict with EU protections for confidential business information.

Third, EU competition law and regulatory frameworks. In certain regulated sectors, data produced under EU regulatory frameworks may be subject to confidentiality obligations under sector-specific EU law. Disclosing such data to a foreign authority without going through EU mutual legal assistance channels could conflict with those sector-specific rules.

Fourth, the Data Act itself. Once the Data Act’s data access and sharing framework is in full operation, the data holder’s rights under the Act may create a conflict if a foreign government demand would allow access that the Act reserves exclusively to authorized parties under defined conditions.

Determining whether a conflict exists requires a legal analysis that considers both the specific demand and the specific data in question. Providers should not make this determination unilaterally or informally. The standard practice in large cloud providers — maintaining a legal team that reviews government requests and applies this analysis — reflects what Chapter IX now effectively requires of all in-scope providers.

The US Legal Process Landscape: CLOUD Act and National Security Demands

To understand what Chapter IX requires in practice for US companies, it is necessary to understand the US legal mechanisms most likely to generate demands for EU-held data. Two deserve particular attention: the CLOUD Act and national security demands under FISA and related authorities.

The CLOUD Act

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted in 2018, allows US law enforcement to compel US-based companies to produce data stored abroad through ordinary domestic legal process — warrants, subpoenas, and court orders — without requiring a mutual legal assistance treaty (MLAT) request to the foreign country. This directly creates the category of demand that Chapter IX is designed to address: a US government demand, backed by US legal authority, for data held in EU data centers.

The CLOUD Act also allows the US to enter into executive agreements with other countries that create a bilateral framework for lawful cross-border data access. The EU and the US have been negotiating such an agreement, and progress has been made in this direction. If and when a US-EU CLOUD Act executive agreement is finalized and takes effect, it may provide a legal basis for certain government data requests that currently lack one under EU law. Until such an agreement is in place and recognized under EU law, CLOUD Act demands remain a primary source of tension between US legal process and EU data protection obligations.

For a US cloud provider operating EU data centers, a CLOUD Act demand creates an immediate conflict analysis obligation under Chapter IX. The provider must assess whether any EU legal basis exists for the transfer, must consider challenging the demand if no such basis exists, and must follow the notification and documentation procedures required by the Act.

National Security Demands

National security demands under FISA, Executive Order 12333, and related authorities present the most difficult compliance situation. These demands are often classified, come with strict confidentiality requirements, and are reviewed by specialized courts (the Foreign Intelligence Surveillance Court) whose proceedings are not publicly accessible. Challenging a FISA order is extraordinarily difficult under US law, and the procedural avenues available are far narrower than for ordinary law enforcement demands.

Chapter IX of the Data Act does not exempt providers from their EU obligations simply because a demand comes from a national security authority. The challenge obligation applies regardless of the type of demand. However, the Act acknowledges practical limits: if all available legal remedies have been exhausted and the demand remains enforceable, compliance may be lawful. The challenge process in the national security context is largely theoretical for most companies, since the specialized legal infrastructure required to contest FISA orders is available only to the largest technology companies with significant legal resources and established relationships with the FISA Court’s procedures.

This practical gap between the legal obligation to challenge and the operational ability to do so effectively is one of the more difficult aspects of Chapter IX compliance. US companies should document their legal analysis and the steps taken, even when the outcome of a challenge is predetermined by the nature of the demand.

Data Residency and Data Sovereignty

Chapter IX of the Data Act is part of a broader EU policy posture around data sovereignty — the principle that data generated and processed in the EU should be subject primarily to EU law and not available for foreign government access on terms that bypass EU legal norms. Data residency — the practice of ensuring that data is stored in servers physically located within a specific jurisdiction — is one technical expression of this principle, though it is not sufficient on its own.

Storing data in EU data centers does not, by itself, prevent foreign government access if the cloud provider is a US company subject to US legal process. As noted above, the CLOUD Act enables US authorities to reach data stored abroad. Chapter IX’s response to this reality is not to prohibit US companies from operating in the EU but to impose obligations on them to challenge unlawful demands and implement technical and organizational measures that reduce the risk of unauthorized access.

Some EU customers and regulators have pushed for more structural solutions: using EU-based providers, architectural designs that prevent the cloud provider from accessing decrypted data (so-called “sovereign cloud” designs with customer-managed encryption keys), or federated arrangements that technically prevent any single provider from having access to the full dataset. These architectural choices can reduce the exposure to government demand risk by limiting what the provider can actually produce even if a valid demand is received.

For US companies selling cloud and data processing services to EU enterprise customers, data sovereignty concerns are increasingly a commercial issue as well as a compliance one. EU customers — particularly in regulated industries like finance, healthcare, and energy — may require contractual commitments about where data is stored, who can access it, and how government requests are handled. Chapter IX of the Data Act gives these customer demands formal regulatory backing.

Structuring a Compliance Response for US Companies

US companies that provide cloud or data processing services to EU customers, or that handle EU-held non-personal data in any capacity, need a structured compliance program for government data requests. The following elements are the foundation of such a program.

Establish a Government Request Review Process

Every US company within scope should have a defined process for reviewing government data requests that could implicate EU-held data. This process should include: identifying which requests involve data held in EU data centers; routing such requests to legal counsel with knowledge of both US legal process and EU Data Act obligations; applying a conflict analysis to determine whether an EU legal basis for the transfer exists; and documenting the outcome of the review and any actions taken.

For larger organizations, this process is likely already in place for GDPR purposes. It must be extended and updated to address non-personal data and the specific requirements of Chapter IX. For smaller organizations that have not previously established a government request process, building one is a threshold compliance requirement.

Implement Technical Measures to Limit Exposure

Chapter IX requires technical measures as well as legal ones. These include: encrypting EU-held data with keys that are controlled by the EU customer rather than the cloud provider (so the provider cannot produce decrypted data even if compelled to provide raw storage); architectural separation of EU data from data stored in other jurisdictions; and access controls that limit which employees and systems can access EU-held data, reducing the scope of what could be compelled through a demand targeting individual employees.

These technical measures are not just compliance tools; they are also a commercial differentiator in EU enterprise markets where data sovereignty is a procurement criterion. Investing in this architecture serves both compliance and business development objectives.

Prepare Standard Response Protocols for Common Request Types

Not every government request requires a full legal analysis from scratch. Companies can develop standard protocols for the most common request types, identifying the typical legal basis (or lack thereof) and the standard response. CLOUD Act warrants involving EU data, for example, might have a standard protocol that includes notification to the EU customer, an assessment of whether an MLAT alternative exists, and a standard challenge motion if no EU legal basis is identified. Having these protocols in place reduces response time and ensures consistency.

Update Customer Contracts and Privacy Policies

EU customers — both businesses and consumers — have a right to know how their data is handled when government requests are received. Data processing agreements and cloud service contracts should include provisions describing the provider’s government request review process, the challenge obligation, the notification procedures, and any technical measures in place. Transparency reports — already published by major cloud providers — should be extended or updated to cover non-personal data handling under the Data Act’s framework.

Conclusion

Chapter IX of the EU Data Act creates real, operational obligations for US companies that hold EU non-personal data. The challenge obligation, the notification requirement, and the mandate to implement technical and legal protections against unauthorized foreign access are not aspirational policy goals — they are legal requirements with enforcement consequences. For US companies, navigating this framework requires understanding the specific US legal mechanisms most likely to generate demands, building a conflict analysis capability into government request processes, and implementing technical architectures that reduce the risk of unauthorized access at the outset. The intersection of US legal process and EU data protection law is one of the most legally complex areas in international technology law, and companies operating in both markets need expert counsel and robust processes to manage it responsibly.