The Securing and Regulating the Digital Space Act was passed on 10 April 2024 and enacted on 21 May 2024. One aspect of the Act includes transitional provisions for cloud computing services. From 12 January 2027, the EU Data Act will come into force and replace the transfer fee provisions of the SREN Act.
The SREN Act provides for national measures to ensure a safer digital space for Internet users and a fairer one for digital players. The law adapts two European regulations into French law: the Digital Services Regulation (DSA) and the Digital Market Regulation (DMA). Several issues are regulated: the protection of minors against pornography, the fight against online hate and disinformation, and the distribution of supervisory powers. In this factsheet, we will focus on the provisions designed to support and secure businesses in their digital transition (articles 26 to 39).
| KEY POINTS | CLARIFICATION |
|---|---|
| Reduced dependence on cloud providers | The cloud provider can only grant a cloud credit for a limited period of time. and may not be subject to any condition of exclusivity. The Cloud Provider may not make the sale of a product or service subject to service in parallel with the conclusion of a cloud services contract. The cloud provider may not apply dissuasive charges when the change of service provider. |
| Enhanced interoperability and portability | Cloud service providers must ensure interoperability and security of their pCloud service providers must ensure the interoperability and portability of their services. |
| Protection of "particularly sensitive" and strategic data | Sensitive data are secrets protected by law, and data necessary for the fulfilment of the State's essential missions, in particular the national security, the maintenance of public order and the protection of the environment. of people's health and lives. Private service providers managing sensitive data must implement the following measures security and data protection criteria, guaranteeing in particular that protection of data processed or stored against access by authorities from third countries not authorised by European Union law. |
"The SREN Act embodies a vision of the cloud that rejects the false dilemma between sovereignty and technological performance. By creating a legal, technical and economic framework conducive to the emergence of credible alternatives, it lays the foundations for a diversified cloud ecosystem where organisations can access advanced digital services without compromising their strategic interests or security."
The procedures for implementing these articles will be specified by decree within 6 months of the date of promulgation of the SREN Act.