France’s law to secure and regulate the digital space (SREN law) was promulgated today, bringing in new rules for the cloud market and for public sector use of cloud services.
Key points
- Rules on cloud switching and data egress fees.
- State bodies must use cloud offers that protect sensitive data from access under non-EU laws.
- SecNumCloud qualification by ANSSI is the reference for such offers.
- The CNIL remains an active enforcer alongside these changes.
UK cloud and SaaS providers selling to French public bodies, or handling sensitive public data, should assess how the sovereignty requirements affect their offers.
Source: Loi n° 2024-449 (SREN) (Légifrance)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
