A cloud provider headquartered in the United States receives a lawful US order under the CLOUD Act to disclose emails of a European customer that are stored only in its EU region. The customer's data protection officer warns that disclosure could breach GDPR transfer restrictions. Which concept best describes this risk?
Select an answer to reveal the explanation.
Short Explanation
Picture two referees with two rulebooks in one game: whichever whistle your provider obeys, the other may call a foul. That's conflicting international legislation, and you'll meet it whenever data and provider sit under different laws. Don't be fooled by the sovereignty claim that one law simply cancels the other.
Full Explanation
Cloud services routinely place data under more than one legal system: the law where the data is stored, the law of the provider's home country and the law of the customer. The US CLOUD Act allows US authorities to compel US-based providers to disclose data in their possession, custody or control even when it is stored abroad, while the GDPR restricts transfers of personal data to third countries and does not treat a foreign court order as a lawful basis for transfer on its own. A provider can therefore face a situation where obeying one regime risks breaching the other, which is the classic conflict of international legislation that CCSP expects cloud customers to evaluate. Data localization is a different requirement about where data must reside; here the data already sits in the EU, and the issue is extraterritorial reach. Claiming EU sovereignty makes the US order legally void ignores that the provider remains subject to its home jurisdiction. Vendor lock-in concerns portability and switching cost, not competing legal obligations. Exam caveat: mitigations include contract terms on handling government requests, transparency commitments and customer-held encryption keys, none of which removes the conflict entirely. Operational check: confirm legal review covers the provider's home jurisdiction and its process for challenging or notifying on government access requests.