France announces strategy for cloud technology

May 18, 2021

Blue and violet gradient

In a press release issued on May 17, 2021, the French government outlined its strategy for the use of cloud technology to protect personal data following increasing concerns in Europe over the surveillance risks posed by global privacy laws with extra-territorial scope affecting EU citizens.

The policy looks to locate cloud service providers’ servers in France, allowing only European companies to operate them, and limiting the ability to transfer data to a third country. Speaking to OneTrust DataGuidance, Sonia Cissé, Counsel at Linklaters said “It is clear that the government’s new policy on the development of a French cloud also aims to address the data transfer issues raised by the Schrems II judgment […] [The policy] would limit global data transfers and offer an alternative to the extraterritorial investigation powers of certain foreign authorities.”

What does the National Cloud Strategy say?

In Monday’s press release, the French Government highlighted the economic and industrial opportunities in France of cloud technologies, whilst also noting the risks posed to the integrity of French data in light of potential foreign access to such data.

The national cloud strategy has three main pillars:

  • The Trusted Cloud Label: A certification will likely be introduced to signal that cloud providers are offering the greatest level of data protection possible, in line with the values of EU data protection law. The certification will be based on the SecNumCloud issued by ANSSI and will be a label of a trusted cloud service provider.
  • A “Cloud at the Centre” Policy: This pillar of the national strategy aims to put cloud computing at the centre of any new digital project in France and seeks to accelerate digital transformation in the country.
  • Ambitious Industrial Strategy: The strategy is aimed at supporting industrial projects that develop cloud technologies in France with a particular focus on PaaS that assist with Big Data and Artificial Intelligence initiatives. The strategy also aims to enhance the technological sovereignty of France and Europe as a whole.


What about US-based cloud providers such as Google and Microsoft?

At a news conference, French Finance Minister Bruno Le Maire said it was his vision that cloud providers such as Google and Microsoft could license their technologies to French companies as part of an initiative to guarantee the location of servers in France as well as European ownership of the companies that store and process the data. This would enable the technological sovereignty being sought by the French Government as well as increase the levels of security around the data of French citizens – the comment was welcomed by both Google and Microsoft.

What is next for the National Cloud Strategy in France?

At this stage, the announcement is a statement of intent from French ministers, however, there are considerations that organizations operating in Europe can bear in mind should these new requirements for public data become law:

  • Store your data in France
  • Use cloud providers that hold the ANSSI certification
  • Use due diligence to ensure the European ownership of the organizations that store and process data

You may also like


Privacy Management

Privacy in practice: PIA & DPIA with PA Consulting

Join OneTrust and PA Consulting as we discuss what makes an effective PIA, best practices, and the benefits of automation.

September 21, 2023

Learn more


Privacy & Data Governance

Privacy in practice for data mapping: With PA Consulting and Syngenta

Join OneTrust and panelists from PA Consulting and Syngenta as we explore practical ways to build an effective data mapping program, best practices, and the need for automation.

September 14, 2023

Learn more


Governance & Policy Management

EU-US DPF: What next for UK businesses?

Join our expert webinar as we discuss the upcoming UK-US DPF Extension and what UK businesses need to prepare to become DPF-certified.

September 06, 2023

Learn more