Clarifying Lawful Overseas Use of Data Act

[Steve-Wilme]

Has anyone addressed the potential conflicy between the US CLOUD Act and GDPR on a practical level?  We have been choosing CSP regions located in EEA countries however the extra-territorial nature of CLOUD would not necessairly be addressed.  Is data encryption, with the keys held on premise a potential way to treat this risk?

[AlecTrevelyan]

There's a good article about this here:

https://iapp.org/news/a/questions-to-ask-for-compliance-with-the-eu-gdpr-and-the-u-s-cloud-act/