iCloud: privacy changes across borders

The economic cost of a backdoor · Part 4 of 7

An encryption option becomes unavailable in one country. Elsewhere, an account’s region determines the provider and the contract. Following Apple’s documents and French cloud rules reveals the value of privacy guarantees and the work involved in changing services.

The same service name can cover two different promises of confidentiality. Apple’s documentation, consulted on November 7, 2026, still states that users in the United Kingdom who do not already have Advanced Data Protection for iCloud enabled can no longer turn it on. Known as ADP, this option extends end-to-end encryption to categories such as backups, photos and files. ^Q01

The customer can continue using iCloud. Yet one feature of the product available to them has changed: the ability to entrust more content to the service while keeping access to the keys on trusted devices. The economic effect begins here, in the quality of the available service. It may then affect a confidentiality commitment, a purchasing decision or a migration project. That chain depends on how the service is used; the sources assembled here cannot put a general price on it. ^Q01Q02

This fourth installment traces how a change in protection can affect the customer’s costs. Apple’s case illustrates the constraints a U.S. provider faces abroad. The Chinese documents show how an account’s region can change the operator and the contract. French and European rules then help explain how a technical safeguard becomes a purchasing requirement and a practical undertaking when leaving a service.

Following the keys

A decryption key is used to turn encrypted content back into readable data. Assessing the protection means identifying the people and systems able to use that key. Apple describes two configurations. Under standard data protection, the categories concerned are encrypted in transit and at rest, with keys held in Apple’s data centers. The provider can therefore help recover them. With ADP, trusted devices retain sole access to the keys for the majority of the data. ^Q02

The UK restriction concerns that extension. In its UK notice, Apple distinguishes 15 categories protected by end-to-end encryption by default, which retain that protection, from 10 additional categories for which new activation of ADP is unavailable. These figures count categories: each square in the diagram represents a type of data, regardless of its size. iMessage and FaceTime also remain end-to-end encrypted. For existing ADP users, Apple describes a process requiring users to disable the feature themselves and says it cannot do so automatically. The actual status of all those accounts is unknown. ^Q01

Method and scope

UK notice dated September 2025, consulted on 7 November 2026. One mark represents one category in that notice, regardless of data volume or user count. These counts are not an exhaustive inventory of services introduced since. The ten categories retain encryption in transit and at rest, with the corresponding keys held by Apple under standard protection. The fifteen default categories retain Apple’s stated protections and exceptions: when Messages in iCloud and iCloud Backup are enabled, a copy of the Messages key enters the backup; under standard protection, Apple holds that backup’s keys. Sharing and metadata also require separate review. The actual status of all pre-existing ADP accounts remains unknown.

This distinction may matter to someone storing sensitive documents. If their requirement is to restrict reading to their devices, they need to examine the protection of the category they use, the recovery arrangements and any copies. Shared content and some metadata have their own rules. The choice turns on that level of detail, well beyond the padlock displayed on a screen. ^Q02

The comparison also needs the right scope. The iCloud terms exclude Managed Apple Accounts from eligibility for ADP. The British case illustrates a change in the offering for eligible accounts; applying it to a business infrastructure requires a separate examination of the service and contract involved. ^Q03

A visible product change, a partly secret dispute

The public evidence serves different purposes. The Investigatory Powers Tribunal’s judgment of April 7, 2025 establishes that Apple brought proceedings concerning the powers to issue Technical Capability Notices, orders relating to technical capabilities. It addresses whether the litigation should be public. Paragraph 20 states that the tribunal neither confirms nor denies the accuracy of press reports about the demand made of Apple. The full text of a notice is therefore a different document from the public judgment on secrecy surrounding the proceedings. ^Q04

The litigation continued in 2026. In submissions signed on September 11, Privacy International and Liberty state that Apple filed a second claim on July 13, 2026. Liberty reports that a case management hearing took place on September 17. These documents come from claimants in the proceedings: they describe their actions and arguments. Their account of a revised demand remains subject to the British government’s position of neither confirming nor denying it. ^Q05Q06

In the United States, Ron Wyden and Warren Davidson called for greater transparency. Their September 11, 2026 press release describes the full scope of the current demand as unknown to the public and to Congress. This is an attributed congressional position, distinct from a judicial finding. ^Q07

For the economic analysis, the observable effect is narrower and better established: Apple’s documentation continues to describe a territorial difference in the service it offers. A diplomatic announcement or procedural development would require a separate check of product availability before concluding that the feature had returned. The material reviewed provides neither a rate of UK customer departures nor lost sales attributable to the restriction. ^Q01Q05

The contract sets out some ways customers can respond. In the iCloud terms revised on September 14, 2026, Apple provides for notice of material adverse changes, with exceptions including circumstances arising from legal or governmental action. The terms also provide, in the specified situations, for termination and a prorated refund of certain prepayments. These clauses describe contractual rights; they establish no compensation actually paid in connection with ADP. Territorial provisions and mandatory legal rights must also be considered. ^Q03

A subscription refund and a digital move address different problems. The first concerns the service paid for. The second may require choosing a solution, transferring data and restoring a working arrangement. The gap between them can leave the customer with a cost even when the refund has been calculated correctly.

Contracts and product availability in China

Apple describes iCloud in mainland China as a service operated by GCBD, AIPO Cloud (Guizhou) Technology Co. Ltd., within China’s regulatory framework. Its support page, dated April 15, 2025, directs the users concerned to specific terms. ^Q08

The version revised on September 14, 2026 provides for a change of operator and contract when a change of region moves an account between Apple and GCBD. It also contains Section II.J on ADP, extending end-to-end encryption and setting out recovery arrangements that rely on the user. The existence of that clause is a documented fact. Establishing who actually holds each key and how the feature is deployed on each account would require further technical verification. ^Q09

The comparison with the United Kingdom calls for examining each feature separately. Apple lists France and the United States for Private Relay in its macOS availability catalog; mainland China is absent. Private Relay and ADP are different features. The catalog describes availability without assigning a precise legal cause to every absence. ^Q12

GCBD’s privacy policy adds a revealing detail. Its April 12, 2024 text provides for storage in China of personal information GCBD processes or generates there. The same section envisages transfers or access from abroad, including by Apple and its affiliates, for the purposes specified. Storage in China can therefore coexist with access from outside it. This is the provider’s description; no independent audit was conducted for this article. ^Q10

Chinese rules themselves require the flow to be classified. Article 40 of the Personal Information Protection Law confines its local storage duty to certain categories of actors. The law provides several routes for transfers and includes encryption among the security measures set out in Article 51. The regulation of March 22, 2024 adds conditional exemptions from certain outbound transfer formalities while retaining applicable protection duties. Inferring a general ban on transfers from the word “China” alone would misread these provisions. ^Q13Q14

Four dimensions of a cloud service

A buyer can clarify this landscape by following four dimensions: the entity with which it signs a contract, the location where data is stored, the teams and systems authorized to administer it, and the actors able to use the keys. The diagram separates these relationships to show where they intersect.

Method and scope

An original hypothetical functional model, without attributing any location or architecture to an actual provider. Routes distinguish contracts, data movement, administration and keys. Real offers may combine or separate the actors shown; each relationship needs documentation. Administrative access and reading content depend on permissions and cryptographic mechanisms. Showing a key in this model gives it no universal reach. Storage location and qualification of a particular offer require their own checks.

A data center’s address answers a physical question. The contracting party helps identify the obligations governing the commercial relationship. Administrative permissions specify who can act on the service. Control of the keys determines the ability to read content within the architecture concerned. Administrative access can be extensive without automatically providing access to every item in plaintext; its reach depends on permissions and encryption mechanisms. France’s data protection authority, the CNIL, stresses precisely the distinction between possession, control, access and use of keys. ^Q16

Consider a buyer assured that its files will remain in a particular country. It still needs answers to the other questions: which entity can receive a demand, which provider can administer the systems, and which operations require a key? This is an illustrative example. It organizes the examination of an offering without attributing to a real provider an architecture that public documents do not describe.

The account’s region adds another layer. Apple’s October 30, 2026 support article describes steps to take before changing a country or region, including matters involving the account balance, subscriptions, pending transactions and a payment method. These requirements document potential work for the user. They belong to the commercial ecosystem; their entire burden cannot be attributed to an obligation to provide access to content. ^Q11

Confidentiality becomes a purchasing requirement

For a French organization, the assessment starts with the function it needs. Keeping an encrypted archive and running a process that must read its contents raise different questions.

The European Data Protection Board illustrates this in its final recommendations on transfers of June 18, 2021. Hosting backups may benefit from an effective supplementary measure where encryption takes place before transmission and meets demanding conditions, including those concerning its strength, implementation and control of the keys. A provider that needs to process the data in plaintext presents a different difficulty where disproportionate access powers in a third country actually apply to the transfer. The Board’s technical assessment dates from 2021 and depends on those assumptions. ^Q15

The commercial question follows: which functions is the buyer willing to entrust to the provider, and with what access? In the common architectures described by France’s data protection authority, the CNIL, client-side encryption can preserve control over content while limiting some collaboration or indexing functions. The choice requires aligning the confidentiality sought with the service actually needed. ^Q16

SecNumCloud qualification adds another set of requirements. France’s cybersecurity agency, ANSSI, describes criteria that include governance, operational autonomy and relationships with third parties subject to laws outside Europe. Qualification applies to a specific offering. An application hosted on a qualified service still needs examination within its own scope; the status does not pass to it automatically. ^Q17

A French document from 2026 shows how these issues enter a concrete purchasing process. The government’s Legal Affairs Directorate has published model clauses for public digital procurement; the PDF examined was updated on August 21, 2026. It brings together safeguards, audit findings, notice of certain changes and termination options. Reversibility, the organised ability to take back or transfer the service, also depends on access to the necessary resources and, for the bespoke developments covered, delivery of code and documentation. These are templates to be incorporated and adapted, with distinct scopes of application. ^Q19

The economic mechanism becomes tangible. If a characteristic required by the buyer changes, its compatibility with the buyer’s needs and the contract must be assessed. Additional evidence, a correction or an exit may become necessary. A new access capability does not, however, automatically entail loss of qualification or termination: that connection would have to be established in the case at hand.

For the provider, a documented safeguard can therefore be a condition of access to certain markets. For the buyer, it has value because it reduces a specific uncertainty. An effect on sales remains a hypothesis until a purchasing or termination decision attributable to the change is observed.

The work involved in switching services

Portability enables data to be transferred in a usable form. Exporting data is an initial stage of the transfer. The steps that follow depend on the use case: locating the expected files, checking their formats, restoring the necessary connections and making sure authorized users can work. An organization may need to run both environments temporarily. This is a project model whose stages must be adapted to the actual situation.

Guidelines issued by the French regulator Arcep on July 2, 2026 give this distinction practical substance. They separate duties to facilitate switching from additional support services. Examples drawn from its work include export assistance, integrity checks, planning, script adaptation and training. How a service is classified depends on its purpose; a required action retains that status even when the customer asks for it. ^Q20

Method and scope

An original teaching model informed by the Data Act, DAJ model clauses and Arcep’s guidelines of 2 July 2026. Arrows show dependencies, without a time scale or budget shares. Coexistence and closure are conditional; retention and deletion duties require review. Rules on some switching and transfer charges are distinct from the customer’s internal work and genuinely agreed additional services. No total migration cost or average duration is estimated.

A team’s time has an opportunity cost: while it reconfigures a service, it has less availability for other work. Estimating that cost would require knowing the scope, the people involved, the hours and the alternatives. This article assigns neither an average duration nor a fictional hourly rate to that work. The examples of tasks establish a mechanism without measuring its scale.

Preparation also changes the decision. Documented exports, usable formats and a tested recovery procedure can reduce the work that has to be improvised when leaving. An integrated service may, in turn, offer enough useful functions to justify staying. The economic decision concerns the complete service, its protection and the available exit options.

Zero euros within a defined scope

The regulatory timetable corrects a common assumption about exit fees. In France, the covered data transfer fees incurred when switching providers have already been capped at zero euros since December 1, 2025. The order is dated November 17, was published on November 30, and provides for this rule to apply until January 12, 2027. ^Q21

January 12, 2027 marks a separate step: the prohibition on switching charges under Article 29 of the Data Act, within its scope. The regulation has generally applied since September 12, 2025 and provides for exit rights, assistance and information about exportable data. Special rules apply, among other things, to certain custom-built services and temporary trials. ^Q18

The two charging scopes need to remain clear. Data transfer is one component of switching; the customer’s project may also require internal work or additional services. Arcep explains that services genuinely going beyond the exit obligations can be charged for, including after January 2027, where they are requested and their price is agreed in advance. Ordinary service charges also follow their own rules. ^Q20

This framework reduces some barriers to switching. Its practical effect will depend on interfaces, exportable data and the work needed to resume operations. A zero-euro line on the invoice can make it easier to decide to leave; the need to restore a working service remains. European exit rules therefore provide a real counterweight to dependence, within a scope that the contract and architecture must allow customers to exercise. ^Q18

The difficulty of valuing trust

At what price would a customer accept a weaker confidentiality guarantee? How much effort would they make to retain a stronger one? Answering these questions could turn the mechanism into an amount. Product documentation and legal texts do not, on their own, supply the necessary data.

A study published in 2021 by Law and Economics Consulting Associates (LECA), commissioned by the Internet Society, illustrates the difficulty. Examining Australia’s Telecommunications and Other Legislation Amendment (Assistance and Access) Act, known as TOLA, it combines nine interviews with a questionnaire that received 79 responses, including 54 from companies headquartered in Australia. It reports economic concerns but acknowledges that the sample cannot support a reliable aggregate estimate. Its targeted recruitment, self-reported responses and the commissioning organization’s interest in strong encryption must inform the reading. Individual companies’ reported amounts are not treated here as verified costs. ^Q23

The Organisation for Economic Co-operation and Development (OECD) and the World Trade Organization, in their study published in February 2025 and revised in August, offer a broader framework for rules governing data flows. Their model combines trade and compliance costs with a trust effect on willingness to pay. This channel rests on assumptions and calibration; it does not measure an observed bill for a backdoor. It nevertheless highlights an essential counterargument: credible safeguards can support use and trade even when they impose obligations on providers. ^Q22

The economic comparison should therefore concern specific configurations. A requirement can increase the compliance burden while making an offering acceptable to some buyers. A restriction on a feature can reduce a product’s usefulness for some customers without prompting all the others to leave. Adding a hypothetical migration cost to an assumed loss of trust could also count the same response twice.

Measuring the effect of compelled access would require tracking changes in the offering, customer decisions, expenditure actually incurred and a credible comparison scenario. The cost of a move already planned for other reasons could not be attributed in full to that obligation. A stated intention to leave would have to remain distinct from an observed departure.

Exit options are part of the purchase

Withdrawal of a protection can have an economic effect before any access to content is publicly documented. In the British case, the restriction on availability is verifiable. The costs that follow depend on the role that guarantee plays in the customer’s use of the service. ^Q01

The Chinese documents require a precise reading of the contract and the features. The French sources show how to specify the evidence expected and prepare for reversibility. Together, they describe a market in which confidentiality is negotiated through technical capabilities, obligations and opportunities to leave. ^Q09Q19

For a buyer, the useful question becomes concrete: if this safeguard changes, can it continue operating with the level of protection it needs, and what means will it have to switch services? The answer lies in access to the keys, the contract terms and the quality of the transition. This is where the debate over backdoors meets a product’s value.

Method and scope

This documentary investigation is current to November 7, 2026. Sources distinguish publication dates, versions and events. Apple and GCBD documents are providers’ statements; claimants’ filings and congressional positions are attributed. Chinese legal texts describe rules without proving how they are implemented on a particular account. No interviews, infrastructure tests or independent audits of key custody were conducted for this article. The diagrams are explanatory models; category counts and charging dates are sourced. No global cost or measured commercial causality is claimed.

Further reading

The sixth part on alternative routes to evidence examines available sources, investigative resources and the work of establishing evidence.

The fifth part on hijacked access and damage distinguishes affected capabilities, recovery and the distribution of losses.

The first part on Parliament’s proposed encryption safeguard examines the French proposal. The second part on devices and backups follows copies of a business secret. The third part on state access examines activation powers and oversight.

The Leaving Microsoft series on government dependencies explores the preparation of an exit. The glossary also explains end-to-end encryption.

The sharing image depicts an archive, a key and transfer paths crossing an abstract border. The conceptual composition illustrates changing safeguards and migration planning; it depicts no actual installation.

Sources

1. Q01 · Apple Support · 2025-09-23 · Accessed 7 November 2026Apple can no longer offer Advanced Data Protection in the United Kingdom to new users
   Passages and scope

   Apple’s UK notice, dated 23 September 2025: fifteen data categories retain default end-to-end encryption, while UK users who have not enabled ADP can no longer enable it for ten additional categories. Those data retain standard protection. Apple describes a user-operated process for existing ADP users and says it cannot disable the feature automatically. The document describes the vendor’s offering and categories, subject to the technical exceptions in Q02. It measures neither data volumes nor customers nor the actual state of every existing account.

   Additional primary document

2. Q02 · Apple Support · 2026-01-05 · Accessed 7 November 2026iCloud data security overview
   Passages and scope

   Apple’s US documentation dated 5 January 2026, covering the two protections, the category table, backups, metadata, sharing and web access. Standard protection retains encryption in transit and at rest, with the corresponding categories’ keys held by Apple. ADP extends end-to-end encryption, while recovery depends on the user’s recovery arrangements. Certain copies, metadata, collaboration features and web sessions have their own rules. These are vendor-defined category counts, without volume weighting or an independent audit.

   Additional primary document

   Additional primary document

   Additional primary document

3. Q03 · Apple Legal · Accessed 7 November 2026iCloud Terms and Conditions : English text
   Passages and scope

   English iCloud terms revised on 14 September 2026. I.D covers geographic availability; I.E covers thirty days’ notice, exceptions and a prorated refund of certain prepayments following termination within that clause. II.J describes ADP and excludes managed and child accounts. Geographic provisions and mandatory rights require separate consideration. These clauses set contractual commitments; this investigation establishes no payment actually made because of the UK withdrawal.

4. Q04 · Investigatory Powers Tribunal · 2025-04-07 · Accessed 7 November 2026Apple Inc v Secretary of State for the Home Department : [2025] UKIPTrib 1
   Passages and scope

   Public judgment dated 7 April 2025 following the hearing on 14 March: paragraphs 1, 6 and 37–43 concern the existence and openness of the proceedings. Paragraph 20 expressly declines to confirm or deny the accuracy of media accounts about the notice. This public summary of a fuller private judgment determines the application for secrecy over the case’s basic details. Its scope differs from a complete notice or a merits judgment on a technical architecture.

   Additional primary document

5. Q05 · Conseils des requérants devant l’Investigatory Powers Tribunal ; copie publiée par Liberty · Accessed 7 November 2026Claimants’ case management submissions : Privacy International, Liberty, Ian Hosein and Ben Wizner
   Passages and scope

   Case-management submissions by Privacy International, Liberty, Ian Hosein and Ben Wizner, signed on 11 September 2026 for the hearing on 17 September. Paragraph 1 identifies Apple’s new claim filed on 13 July; paragraphs 2–9 describe procedural developments and proposed management. The authors are parties to the litigation. Their assertions about the revised notice and their challenge to secrecy remain attributed. This filing contains their arguments and procedural account rather than the tribunal’s final findings.

6. Q06 · Liberty : Poppy Bourke, Lawyer · 2026-09-22 · Accessed 7 November 2026Why we’re challenging the UK Government’s attempts to break encryption
   Passages and scope

   Liberty lawyer Poppy Bourke’s account published on 22 September 2026, particularly the section on the next steps in the litigation. Liberty reports the 17 September hearing and its challenge to the government’s neither-confirm-nor-deny position. Its 4 August release discusses Apple’s second challenge. These materials document a party’s actions and position; technical and legal criticism, and information drawn from press accounts, remain attributed to their authors.

   Additional primary document

7. Q07 · Office of U.S. Senator Ron Wyden · 2026-09-11 · Accessed 7 November 2026Wyden and Davidson to UK Spy Court: Let Apple Tell Congress About Reported UK Secret Demand for Encryption Backdoor
   Passages and scope

   Senator Ron Wyden’s release of 11 September 2026 announcing a joint letter with Warren Davidson to the UK tribunal. The lawmakers seek permission for Apple to inform Congress and describe the current request’s full scope as unknown to the public and Congress. The reference documents a parliamentary position and information the lawmakers report receiving. It differs from a judicial finding, the text of a notice or an independent technical confirmation.

8. Q08 · Apple Support · 2025-04-15 · Accessed 7 November 2026Learn more about iCloud in China mainland
   Passages and scope

   Apple support page dated 15 April 2025: mainland China’s iCloud service is described as operated by GCBD, AIPO Cloud (Guizhou) Technology Co. Ltd., under specific terms. Apple’s stated option to change region carries a citizenship and residence condition. This documentation describes the vendor’s stated commercial organisation and contractual framework. It does not reconstruct the actual custody of each key or the service’s internal architecture.

9. Q09 · GCBD / Apple, conditions contractuelles publiées sur apple.com · Accessed 7 November 2026iCloud operated by GCBD Terms and Conditions
   Passages and scope

   Terms for iCloud operated by GCBD, revised on 14 September 2026. The introduction identifies the provider, support by Apple entities and the contractual consequences of region migration in both directions. II.J contains an ADP clause with end-to-end encryption and user-managed recovery; managed and child accounts are excluded. The clause establishes the contract’s content. Deployment on a particular account and actual custody of each key require their own technical examination.

10. Q10 · GCBD, politique publiée sur icloud.com.cn · 2024-04-12 · Accessed 7 November 2026Privacy Policy for iCloud operated by GCBD
    Passages and scope

    GCBD privacy policy published on 12 April 2024, particularly its cross-border transfer section. It states that personal information processed or generated by GCBD in China is stored there, while also providing for transfers or access from abroad, including by Apple and its affiliates, for the stated purposes. This is the provider’s declaration. Storage location, access rights, actual transfers and key architecture remain distinct objects of assessment.

11. Q11 · Apple Support · 2026-10-30 · Accessed 7 November 2026Change your Apple Account country or region
    Passages and scope

    Apple’s procedure published on 30 October 2026, covering preparation and obstacles before changing account country or region. Balances, certain subscriptions, expiry dates, pending transactions, Family Sharing, payment methods and content availability can require action. Cancelling Apple One or iCloud+ reduces storage to the free five-gigabyte plan. The operating documentation describes potential work, without providing an average duration or cost or attributing these general constraints to a content-access obligation.

12. Q12 · Apple · Accessed 7 November 2026macOS Feature Availability : iCloud: Private Relay
    Passages and scope

    The macOS availability catalogue as consulted on 7 November 2026, specifically the iCloud: Private Relay list up to the next section. France and the United States are listed; mainland China is absent, while Hong Kong and Macao appear separately. This establishes announced availability of a specific feature. Private Relay and ADP are distinct; the catalogue supplies neither a legal cause for each omission nor a countrywide security ranking.

13. Q13 · Comité permanent de l’Assemblée populaire nationale ; copie officielle publiée par la SAMR · 2021-11-05 · Accessed 7 November 2026Personal Information Protection Law of the People’s Republic of China
    Passages and scope

    Adopted on 20 August 2021 and effective from 1 November 2021. Articles 38 to 41 set out several routes and conditions for transfers. Article 40 applies local storage duties to defined categories of actors and allows exceptions to outbound assessment. Article 51 includes encryption and permission controls among security measures. The particular flow and its implementation by a provider still require examination.

14. Q14 · Cyberspace Administration of China (CAC), ordre no 16 · 2024-03-22 · Accessed 7 November 2026Provisions on Promoting and Regulating Cross-Border Data Flows
    Passages and scope

    CAC Order No. 16, published and effective on 22 March 2024. Articles 3 to 6 exempt specified flows from listed formalities, subject to conditions; Articles 10 and 11 preserve applicable protection duties. The 30 January 2026 FAQ explains how the routes interact and refers back to the exemptions. A formal exemption and the effective security of a transfer are separate matters.

    Additional primary document

15. Q15 · European Data Protection Board / Comité européen de la protection des données · 2021-06-18 · Accessed 7 November 2026Recommendations 01/2020 on measures that supplement transfer tools : version 2.0
    Passages and scope

    Final version 2.0, adopted on 18 June 2021. Annex 2, Use Case 1 concerns storage encrypted before transmission, under six conditions covering strength, implementation and key control. Use Case 6 concerns processing that requires plaintext where disproportionate access powers actually apply to the transfer. The technical assessment is dated and conditional; compliance requires examination of the actual case.

    Additional primary document

16. Q16 · CNIL · 2024-01-22 · Accessed 7 November 2026Encryption practices in the public cloud
    Passages and scope

    CNIL analysis dated 22 January 2024: data states; possession, control, access and use of keys; client-side and server-side encryption. Indexing, collaboration and metadata have their own requirements. This account explains common architectures without auditing a particular offering or establishing an observed purchasing decision.

17. Q17 · ANSSI · Accessed 7 November 2026FAQ on preparing for SecNumCloud qualification
    Passages and scope

    ANSSI’s SecNumCloud FAQ: qualification of a defined offering, technical and legal criteria, operational autonomy and relationships with third parties. ANSSI states that qualification does not determine the security of the customer’s hosted digital service. The qualified scope, configuration and uses need to be assessed together. The page gives no separate publication date.

18. Q18 · Parlement européen et Conseil / Journal officiel de l’Union européenne / EUR-Lex · 2023-12-22 · Accessed 7 November 2026Regulation (EU) 2023/2854 : Data Act
    Passages and scope

    Published on 22 December 2023 and generally applicable from 12 September 2025. Articles 23 to 30 govern switching; Article 29 prohibits the corresponding charges from 12 January 2027. Article 31 provides special regimes for certain custom-built services and temporary trials. Ordinary charges, additional services and the customer’s own work concern separate scopes.

19. Q19 · Direction des Affaires juridiques / Ministère de l’Économie · 2026-05-06 · Accessed 7 November 2026Implementing Article 31 of the SREN Act and model clauses for digital procurement sovereignty
    Passages and scope

    DAJ guidance and model clauses, PDF updated on 21 August 2026. Annexes 1.A and 1.B address qualification, information, audit results, changes and termination options within defined scopes. Annex 2 covers reversibility, access to necessary resources and rights over specified bespoke developments. The models require incorporation and adaptation to the contract; publication alone does not establish their use in every agreement.

    Additional primary document

20. Q20 · Arcep · 2026-07-02 · Accessed 7 November 2026Guidelines on cloud switching costs other than data transfer fees
    Passages and scope

    Arcep’s final guidelines dated 2 July 2026. Sections 2 to 4 distinguish facilitation duties, additional services and examples of migration tasks and resources. Genuinely additional services may remain chargeable after 12 January 2027 where the customer requests them and agrees the price in advance. The classification identifies the matters to separate; it measures no representative total project cost.

    Additional primary document

21. Q21 · République française / Légifrance · 2025-11-30 · Accessed 7 November 2026Order of November 17, 2025 setting a zero cap on data transfer fees when switching cloud providers
    Passages and scope

    Order dated 17 November 2025, published on 30 November. Articles 1 and 2 cap the specified data-transfer fees incurred when switching providers at zero euros from 1 December 2025 until 12 January 2027. The consolidated version is displayed as in force on 7 November 2026. The cap concerns those regulated fees; project costs, internal work and additional services remain separate.

    Additional primary document

22. Q22 · OCDE / Organisation mondiale du commerce · 2025-02-10 · Accessed 7 November 2026Economic Implications of Data Regulation: Balancing Openness and Trust
    Passages and scope

    OECD/WTO publication dated 10 February 2025; PDF revised in August 2025. Sections 3.1 and 3.2 and Annex C model scenarios combining trade costs, compliance and trust-related willingness to pay. The effects depend on assumptions and calibration, including a business questionnaire. The corrigendum changes two categories in Figure 2.3. These simulations provide a comparison framework rather than a measured loss attributable to ADP or a particular backdoor.

    Additional primary document

    Additional primary document

23. Q23 · LECA ; étude commandée et publiée par Internet Society · 2021-06-01 · Accessed 7 November 2026The Economic Impact of Laws that Weaken Encryption : Law and Economics Consulting Associates
    Passages and scope

    LECA study commissioned by the Internet Society and released on 1 June 2021; the PDF is dated 5 April 2021. Section 6 reports nine interviews and 79 questionnaire responses, including 54 companies headquartered in Australia. The report acknowledges insufficient evidence for a reliable aggregate estimate. Sponsorship, targeted recruitment and self-reports qualify the findings; individual amounts are separate from independently verified costs.

    Additional primary document