What is extraterritorial law?
Extraterritorial law is law that a country applies to people, companies or data beyond its own borders.
Many countries have such rules. The GDPR is one example, since it applies to companies outside the EU that offer services to people in the EU. The US CLOUD Act is another.
For data, it means that several countries' laws can apply at the same time. Where the data is stored plays a part, and so does who owns and controls the supplier.
When two laws require different things, a supplier can end up in a conflict of laws. Responsibility for the data still stays with the organisation that handed it over.
How it works
The link to the country can be ownership, registered office, where a service is offered or who controls the data. If the link is strong enough, the law can apply even when the activity takes place elsewhere. A single assignment can therefore be covered by the laws of more than one country at the same time.
Why it matters
eSam, the Swedish public sector body for digital collaboration, notes that other countries' laws can have an extraterritorial effect on public clouds. So it is rarely enough to ask where the servers are. Data sovereignty is as much about ownership and control, and the CLOUD Act is an often cited example.
What to keep in mind
Rules that reach beyond a country's borders often have a legitimate purpose, such as law enforcement or the protection of personal data. Find out which of them apply to your data.
Do the mapping service by service. One provider can use different companies, regions and sub-suppliers for different parts.
What it means for you
Ask which countries' laws apply to the supplier, to its owners and to its sub-suppliers.
Common questions
Is the GDPR extraterritorial too?
Yes. It also applies to companies outside the EU that offer goods or services to people in the EU, or that monitor their behaviour here.
How do we know which laws apply to a service?
Ask the supplier about ownership, registered office, where it operates and which sub-suppliers are involved. That shows which countries' laws can reach the data.
Sources: GDPR, Article 3, on EUR-LexeSam on the cloud question
Related terms
Read more
All terms Updated