Home 5 Resources 5 The EU–US cloud agreement and its impact on European companies
Compliance

The EU–US cloud agreement and its impact on European companies

2025-03-24

With the increasingly uncertain relationship between the EU and the US, Swedish companies are reassessing where they store their data—and many are looking closer to home. Choosing European cloud services offers not only legal security but also a competitive advantage, providing greater control, stability, and long-term business continuity. “The question is not if, but when the European Commission will invalidate the adequacy decision, which would mean that US cloud services no longer meet GDPR requirements”, says Johan Weréen, compliance expert at Glesys.

Among EU countries, Sweden stands out as one of the largest investors in cloud services. For many companies, these services have become business-critical. According to Johan, awareness of where data is stored has grown significantly compared to just a few years ago:

“More and more companies are realizing the strategic benefits of storing their data within Europe, especially when it comes to ensuring long-term stability and regulatory compliance.”

The Trump administration’s recent rollback of measures to protect European data flows, combined with promises to revoke several of Biden’s security orders, has serious consequences for the future of EU–US data transfers. These changes have created uncertainty around the legal framework, potentially weakening protections for European data. While the European Commission has deemed the level of protection sufficient under certain conditions in the Data Privacy Framework, political instability increases the risks for companies relying on US-based cloud providers.

"An adequacy decision remains valid until the European Commission withdraws it or the Court of Justice of the European Union overturns it. If that happens, Swedish businesses will need to find alternative solutions quickly." – Johan Weréen

Exit strategy – Why your business needs a plan B

The ability to change cloud providers when needed is crucial for maintaining control and stability. To avoid dependency on a single provider, companies need a well-thought-out exit strategy that allows them to migrate data, applications, and services quickly and smoothly—either to another cloud platform or back to their own IT infrastructure.

There are several reasons a migration may be necessary, including unfavorable contract terms, increased security risks, or changing regulatory requirements. Without a clear plan, businesses risk vendor lock-in, which limits flexibility and creates obstacles when conditions change. With growing uncertainty around data regulations, a well-prepared exit strategy is vital to safeguard critical information and ensure business continuity. Without one, companies may face data loss, service disruptions, or compliance issues—outcomes that can have serious financial and legal consequences.

Read more about cloud exit strategies in our blog

Choosing a European cloud provider

The latest developments in data transfers between the EU and the US make it clear that the most sustainable and secure option is to store data within Europe. The EU’s data protection regulations and focus on data sovereignty create a stable and predictable environment—essential for maintaining business continuity and minimizing risks. This is particularly critical in finance and healthcare, where handling sensitive information requires strict security and compliance.

“For many businesses, the choice of cloud provider is no longer just about meeting legal requirements—it’s a strategic investment to ensure long-term stability and protect the company’s most valuable asset: its data,” says Johan.

Johan Wereen
About the author
Johan Weréen serves as Customer Success Manager at Glesys, specializing in compliance and secure infrastructure operations. He supports organizations in navigating complex GDPR requirements, enhancing onboarding processes to improve customer experience, and reinforcing data protection practices across diverse technical environments.