The promise of cloud computing remains simplicity: infrastructure as a service, software on demand, scalability without capital investment. The legal reality is considerably more complex. When a Swiss company stores data with a cloud provider headquartered in the United States, operating data centers in Ireland and Singapore, the question of applicable law becomes genuinely difficult, and the November 2025 privatim resolution on international cloud solutions suggests it may be more difficult than many organizations have assumed.1Art. 16 f. DSG (SR 235.1), establishing the framework for cross-border data transfers.
1. The Illusion of Data Localization
Many cloud service agreements offer "data residency" options, promising that customer data will be stored in specific geographic regions. However, storage location and processing location are not the same thing. Data stored in a Swiss data center (data "at rest") may be accessed, processed, or analyzed from technical support centers located anywhere in the world. Jurisdictional analysis has to separate where data resides from where, and by whom, it may be accessed or processed.
Where data is stored matters less than who controls the infrastructure and which sovereign's laws that controller answers to.
Many cloud services also run automatic failover, backup replication, and disaster recovery across multiple regions. What happens to data residency commitments when the primary data center experiences an outage? Does temporary processing in a backup location constitute a contractual breach or a reasonable operational necessity? Standard agreements rarely address these questions with precision.
Under the Bundesgesetz über den Datenschutz (DSG), cross-border disclosure requires either adequate protection in the destination country or appropriate safeguards.2DSV (SR 235.11), Annex 1: list of countries with adequate protection. But a country-level adequacy finding leaves open how individual data flows within a complex cloud service are treated. If the processing takes place in the context of the activities of an establishment in the European Economic Area, the GDPR applies as mandatory law regardless of what the contract specifies; regulatory obligations are not subject to party autonomy in choice of law.3Art. 3(1)–(2) GDPR (territorial scope); see also Case C-311/18 Schrems II [2020] ECLI:EU:C:2020:559. The same data flow may simultaneously require analysis under Swiss DSG and GDPR frameworks, each with distinct requirements for lawful processing, transfer mechanisms, and controller-processor arrangements.
2. When Adequacy Is Conditional
The rules for cross-border transfers changed on 15 September 2024, when Switzerland's recognition of the United States as providing adequate protection under the Swiss-US Data Privacy Framework became effective.4DSV amendment 15 September 2024, adding the US (for DPF-certified recipients) to Annex 1. Under this framework, Switzerland recognizes the US as providing adequate data protection for transfers to DPF-certified recipients, eliminating the need for additional transfer mechanisms such as Standard Contractual Clauses or transfer impact assessments. Other compliance obligations (purpose limitation, proportionality, security requirements, and processor contract terms) remain applicable regardless of the transfer basis.
However, the DPF does not resolve all jurisdictional complexity. Certification is voluntary and company-specific: not all providers are certified, and certification scope may not cover all services a provider offers. The DPF addresses personal data transfers but does not affect trade secrets, professionally secret information, or other sensitive categories that fall outside its scope.
The durability of the framework itself presents a separate consideration. The EU's analogous frameworks (Safe Harbor and Privacy Shield) were both invalidated by the Court of Justice of the European Union.5Case C-362/14 Schrems [2015] (Schrems I), invalidating Safe Harbor; Case C-311/18 Schrems [2020] (Schrems II), invalidating Privacy Shield. The Swiss-US DPF is a separate Swiss adequacy decision not subject to CJEU jurisdiction, but the underlying US legal environment that prompted those EU invalidations has not fundamentally changed. Which contingency arrangements would apply if Switzerland were to reassess its adequacy finding is a question the DPF itself does not answer.
The Swiss-US DPF rests on Executive Order 14086, which established a Data Protection Review Court mechanism for non-US persons to challenge surveillance activities; Swiss residents gained access to that mechanism only when the US Attorney General designated Switzerland a "qualifying state" in June 2024.6Attorney General designation of Switzerland as a 'qualifying state' under EO 14086, effective 15 September 2024. Unlike Safe Harbor and Privacy Shield, this framework was designed specifically to address the Schrems II concerns about lack of judicial redress. However, Executive Orders can be modified or rescinded by subsequent administrations without Congressional action, and the framework is already under strain: the Privacy and Civil Liberties Oversight Board lost its operating quorum in January 2025, and although the EU's parallel framework survived the Latombe annulment challenge before the EU General Court in September 2025, that judgment is under appeal.7PCLOB quorum loss (Jan 2025); Latombe dismissed by the EU General Court (3 Sept 2025), under appeal. The framework's foundations are thus executive rather than legislative, creating a structural vulnerability for arrangements that rely on it. Whether Swiss authorities would reassess adequacy in response to US executive action, and on what timeline, remains uncertain.
Where the DPF does not apply, organizations typically rely on SCCs under Art. 16(2)(d) DSG, supplemented by transfer impact assessments.8Art. 16(2)(d) DSG; cf EDPB, Recommendations 01/2020 on supplementary measures for SCCs (18 June 2021). But the structural problem the Schrems II decision identified persists: contractual commitments cannot override a provider's statutory obligation to comply with foreign government access orders. For US-bound transfers outside the DPF, the assessment must address the CLOUD Act, FISA Section 702, and Executive Order 12333, producing conclusions that will rarely be unambiguous. Even where the DPF covers the primary transfer, the provider's subprocessors may be subject to the laws of other countries, a risk the framework does not cover.
3. Where Oversight Ends in the Subprocessor Chain
Enterprise cloud services rarely operate in isolation. A primary cloud provider may rely on dozens of subprocessors for specific functions: content delivery networks, security monitoring, analytics services, and customer support tools. Each subprocessor relationship introduces additional jurisdictional considerations.9EDPB, Recommendations 01/2020 on measures supplementing transfer tools (18 June 2021).
Art. 9 DSG establishes the statutory framework for processor relationships. A controller may only engage a processor if the processing is carried out in a manner the controller itself could lawfully perform, and no statutory or contractual duty of confidentiality prohibits the delegation.10Art. 9 DSG (Bearbeitung durch Auftragsbearbeiter), imposing conditions on processor engagement. In cloud arrangements, this second requirement (no prohibition on delegation) intersects directly with professional secrecy obligations. Where data subject to Art. 321 StGB or Art. 47 BankG is processed in the cloud, the controller must verify that the delegation itself does not breach the confidentiality obligation, a question that extends to every subprocessor in the chain.
Standard cloud contracts typically include broad authorization for subprocessor engagement, with notice provisions that allow changes on short timelines. But what practical oversight can a customer exercise when the subprocessor list spans hundreds of entities across dozens of jurisdictions?
The EDÖB's guidance on transfer impact assessments requires exporters to evaluate the primary recipient and the full chain of processing behind it.11EDÖB, Datenbearbeitungen in der Cloud (July 2024), establishing guidance on cloud outsourcing and transfer impact assessments. For complex cloud arrangements, this evaluation may be practically impossible to complete with confidence. How does an organization verify that subprocessor security controls meet requirements when audit rights do not extend through the chain? What audit rights actually apply at the third or fourth tier of subcontracting? When a subprocessor is located in a jurisdiction without adequate protection, and without DPF certification, what safeguards apply, and who bears responsibility for implementing them?
The notice-and-objection model typical of cloud contracts makes this worse: if a provider adds a subprocessor in a problematic jurisdiction, the customer's objection right may be limited to contract termination, a remedy that is commercially impractical for deeply embedded services.
Art. 22 DSG requires a Datenschutz-Folgenabschätzung (DPIA) where processing is likely to result in high risk to data subjects.12Art. 22 DSG (Datenschutz-Folgenabschätzung), requiring impact assessment for high-risk processing. Cloud arrangements involving cross-border subprocessor chains, possible government access, and limited audit rights will frequently trigger this threshold, and where particularly sensitive personal data under Art. 5(c) DSG is involved, the assessment is legally required before processing begins.
4. Government Access and the CLOUD Act Question
The reach of government surveillance and data access requests extends across borders in ways that cloud service contracts rarely address clearly. A cloud provider incorporated in the United States remains subject to the Clarifying Lawful Overseas Use of Data Act (CLOUD Act),13Clarifying Lawful Overseas Use of Data Act (CLOUD Act), Pub. L. No. 115-141, div. V, 132 Stat. 1213 (2018), codified at 18 U.S.C. §§ 2523, 2703(h) and 2713 (short title at 18 U.S.C. § 1 note). which permits US authorities to compel disclosure of data in the provider's possession, custody, or control, regardless of where that data is physically stored.
This creates a structural tension that contractual provisions cannot fully resolve. Data stored in a Swiss data center, operated by a Swiss subsidiary, may nonetheless be subject to US disclosure requirements if the ultimate parent company is US-incorporated. The DPF addresses surveillance in the intelligence context through oversight mechanisms established under Executive Order 14086,14Exec. Order No. 14086, 87 Fed. Reg. 62283 (14 October 2022) (Enhancing Safeguards for United States Signals Intelligence Activities). but the CLOUD Act operates through different legal channels (law enforcement rather than intelligence gathering), and those channels are not addressed by the adequacy framework.
The CLOUD Act's comity provisions, which permit a provider to move to quash or modify legal process for the contents of communications where disclosure would create a material risk of violating a "qualifying foreign government's" laws, require an executive agreement with the United States that Switzerland has not concluded.1518 U.S.C. § 2703(h)(2) (motion to quash or modify); see also 18 U.S.C. § 2523 (executive agreement requirements). These challenge rights are therefore largely unavailable for Swiss data, leaving only the weaker, discretionary basis of common-law comity.
Swiss law creates a counter-obligation. Art. 271 StGB criminalizes acts performed on Swiss territory on behalf of foreign authorities without authorization, a tension that the analysis of Swiss professional secrecy and international e-discovery covers for discovery requests.16Art. 271 StGB (Verbotene Handlungen für einen fremden Staat). Whether compliance with a CLOUD Act order would violate Art. 271 StGB remains uncertain; the provision's application to cloud service arrangements has not been authoritatively resolved, creating a situation where the provider may face conflicting legal obligations with no clear hierarchy.
The Swiss and EU Responses
Swiss regulatory authorities have taken an increasingly firm position on this question. On 18 November 2025, the Conference of Swiss Data Protection Commissioners (privatim) adopted a resolution concluding that SaaS solutions from international cloud providers are generally unsuitable for processing particularly sensitive personal data or data subject to confidentiality obligations by Swiss public bodies, unless the public body implements customer-controlled encryption to which the provider has no access.17privatim, Resolution zur Auslagerung von Datenbearbeitungen in die Cloud (18 November 2025). The resolution, which represents the collective position of cantonal data protection authorities rather than binding law, found that most international SaaS solutions (Microsoft 365 foremost among them) lack encryption preventing provider access to plaintext data. For data subject to official secrecy (Amtsgeheimnis), outsourcing to providers subject to the CLOUD Act creates legal uncertainty that contractual safeguards cannot resolve.
The privatim resolution aligns with the Federal Council's broader Cloud Strategy for the Federal Administration (Cloud-Strategie der Bundesverwaltung, 2020), which prioritizes sovereign cloud solutions for federal data classified as requiring heightened protection, while permitting public cloud services for lower-sensitivity categories subject to appropriate safeguards.18Schweizerischer Bundesrat, Cloud-Strategie der Bundesverwaltung (2020), defining multi-cloud approach with sovereignty requirements. The strategy reflects a multi-cloud approach (sovereign infrastructure for the most sensitive workloads, commercial cloud for the rest) that private sector organizations handling regulated data may find instructive as a risk-stratification model.
While these pronouncements address the public sector specifically, for private sector organizations handling data subject to professional secrecy, including medical confidentiality under Art. 321 StGB19Art. 321 StGB (Verletzung des Berufsgeheimnisses), criminalizing disclosure of professional secrets by physicians and other listed professions. and banking secrecy under Art. 47 BankG20Art. 47 Bundesgesetz über die Banken und Sparkassen (Bankengesetz, BankG) vom 8. November 1934 (SR 952.0)., the same underlying tension applies. These organizations have to judge whether the risk of a disclosure request affecting specific data categories is low enough to accept, given that the cloud arrangement must satisfy sector-specific obligations beyond general data protection requirements.
Banks and insurers carry further cloud rules. In Switzerland FINMA Circular 2018/3 requires audit rights that apply wherever the data is held.21FINMA Circular 2018/3 Outsourcing: banks and insurers (Auslagerung bei Banken und Versicherern), Rz 27 ff. In the EU the Digital Operational Resilience Act has, since 17 January 2025, placed designated critical ICT third-party providers, the major cloud platforms among them, under direct supervision by the European Supervisory Authorities.22Regulation (EU) 2022/2554 (DORA), applicable 17 January 2025; oversight of critical ICT third-party providers.
The revised DSG reinforces these obligations with criminal sanctions. Art. 60 ff. DSG impose personal liability (fines up to CHF 250,000) on individuals who willfully breach duties of care in cross-border transfers or violate professional secrecy in connection with data processing.23Art. 60 ff. DSG (Strafbestimmungen), imposing personal criminal liability up to CHF 250,000 for wilful breaches. Liability attaches to compliance officers, IT directors, or senior management rather than to the organization, and where a cloud arrangement leads to unlawful disclosure, those individuals remain liable even if foreign law compelled the disclosure. Standard procurement processes rarely address the circumstances under which foreign disclosure might occur, what notification the customer would receive, or whether contractual commitments to challenge orders would provide meaningful protection or merely procedural delay.
5. When the Cloud Relationship Ends
Cloud service agreements create dependency relationships that become apparent primarily at termination. When the relationship ends (through expiration, breach, or provider insolvency), the practical questions multiply: what export formats are available, whether those formats are usable without the provider's proprietary systems, what transition assistance exists and at what cost, and whether data transformed during processing can be recovered in its original structure.
Provider insolvency presents particular challenges. Cloud contracts typically do not create security interests in customer data, and contractual access rights may be unenforceable or subordinate to creditor claims in a foreign insolvency proceeding. For regulated industries, these questions intersect with record-keeping obligations, creating compliance problems that may only become apparent years after termination, when the commercial relationship that created the data has long since ended.
Since 12 September 2025, the EU Data Act has reshaped these exit questions for any cloud arrangement touching an EU establishment. Chapter VI Data Act obliges providers of data processing services (IaaS, PaaS, and SaaS alike) to remove obstacles to switching to a competing service or to on-premises infrastructure and to support structured data export. Providers of infrastructural (IaaS-type) services must additionally facilitate functional equivalence in the destination service, and other services must offer open interfaces. Switching charges must be withdrawn entirely from 12 January 2027.24Regulation (EU) 2023/2854 (Data Act), Ch. VI switching; applicable 12 September 2025. The regime binds providers irrespective of their place of establishment whenever the customer is in the EU, so a Swiss group's EU subsidiaries may acquire portability rights that its Swiss-contracting entities do not, a divergence that may surface only at termination.
6. Where Contractual Certainty Meets Jurisdictional Reality
For Swiss organizations evaluating cloud service arrangements, the rules have become more complex. The Swiss-US DPF provides a pathway for certain personal data transfers, but does not eliminate the underlying jurisdictional tensions. The November 2025 privatim resolution signals that Swiss authorities are taking an increasingly skeptical view of whether US-controlled cloud services can satisfy data protection requirements for sensitive categories of information.
Which countries' laws apply depends on every subprocessor in the chain as well as on the primary provider, and each link raises its own regulatory questions. Contractual provisions addressing the intersection between Swiss data protection requirements and foreign government access may appear protective but prove unenforceable against a provider subject to conflicting legal obligations. Data residency commitments face a similar gap: operational exceptions for failover, support access, and subprocessing may render geographic restrictions largely aspirational in practice. Where cloud services support regulated products (medical devices, pharmaceutical manufacturing systems, or clinical trial databases), the cloud arrangement becomes part of how the product meets its regulatory requirements, and the liability consequences reach the EU-AR and beyond (see the analysis of the liability of EU authorized representatives).
Cloud agreements routinely cap provider liability at a fraction of annual fees, but Art. 100 OR prohibits excluding liability for intentional or grossly negligent breach.25Art. 97 OR (Nichterfüllung) and Art. 100 OR (prohibition on excluding liability for intentional or grossly negligent breach). Where inadequate safeguards lead to unlawful disclosure, the distinction between ordinary and gross negligence determines whether the cap applies, and Swiss courts have not yet defined with precision the duty of care (Sorgfaltspflicht) expected of a cloud provider that processes regulated data across borders.
For organizations processing data subject to professional or official secrecy, the threshold question may be whether cloud processing is lawful at all, a question that the EDÖB's 2024 cloud computing guidance and the November 2025 privatim resolution have made increasingly difficult to avoid.
Where cloud infrastructure supports high-risk AI systems, the EU AI Act also imposes data governance, record-keeping, and transparency requirements on providers and deployers, which overlap with data protection obligations but are distinct from them.26Regulation (EU) 2024/1689 (AI Act), Art. 6, 10, 12, 13; see also Art. 2(1)(a) on territorial scope. For Swiss organizations deploying AI via US-headquartered cloud providers into the EU market, three regimes apply at once (Swiss DSG, EU AI Act, and US CLOUD Act), each with its own jurisdictional triggers.
The cloud is a set of contractual relationships resting on physical infrastructure controlled by entities subject to the laws of several sovereigns. Working out which laws reach those relationships takes an analysis that standard procurement templates do not provide.