The CLOUD Act and Your Data in India: What Your Hyperscaler's Sales Team Never Told You
Picture this: your cloud sales representative has just given you a very polished presentation. Your data, they assure you, lives in AWS Mumbai or Azure India.
Picture this: your cloud sales representative has just given you a very polished presentation. Your data, they assure you, lives in AWS Mumbai or Azure India. It never leaves India. They point to the MeitY empanelment certificate as the final proof that everything is compliant, secure, and fully within Indian legal jurisdiction. You nod. You sign the contract.
What they did not tell you, and what this article will, is that a United States federal law signed in 2018 gives American law enforcement the legal authority to compel that same cloud provider to hand over your data, regardless of which country it is physically stored in, without requiring the consent or even the knowledge of the Indian government or your own organisation.
That law is called the Clarifying Lawful Overseas Use of Data Act. The world knows it as the CLOUD Act. And if your organisation stores data with any US-headquartered cloud provider, whether on servers in Mumbai, Hyderabad, or the moon, you need to understand what it means for you.
Why this matter right now
In July 2025, Microsoft abruptly suspended access to all its services for Nayara Energy, India's second-largest private oil refiner handling 8% of the country's refining capacity. The suspension, triggered unilaterally by Microsoft based on EU sanctions, happened without a court order, without prior notice to the company, and without any involvement of Indian regulatory or judicial authority. Nayara Energy had to go to court to regain access to its own data and systems. This was not a data extraction event, but it demonstrated, graphically, what it means to depend on a US company for your business-critical infrastructure: that company can act on foreign legal and political pressure at any time, and India may have no immediate remedy. for more details visit Zeacloud's The CLOUD Act and Your Data in India: What Your Hyperscaler's Sales Team Never Told You Blog













