Inside the EU does not mean outside the Cloud Act
A common assumption is that having a Dutch branch, a local subsidiary, or a data center within the EU provides sufficient guarantee for digital sovereignty. Unfortunately, that is not the case. It is not about where the data is stored, but which legislation the (parent) organization is subject to. If a supplier is American-owned, it falls under the U.S. Cloud Act, regardless of whether the infrastructure runs in the Netherlands or invoices are sent by a Dutch entity. In such cases, authorities can demand data, with or without the customer's knowledge.
This is not a theoretical risk or a political stance; it is a legal reality that must be taken into account when planning new Cloud infrastructure.