Health, financial and strategic data are migrating to the cloud faster than the frameworks meant to govern them. The HDS framework covers 6 distinct hosting activities and, since its 2024 revision, requires storage and processing to be located within the European Union; ANSSI's SecNumCloud 3.2 framework adds ownership and legal criteria; the European EUCS scheme, which provides for 3 assurance levels, has still not been adopted.
Pressure no longer comes solely from supervisory authorities but from contracts. DORA has applied to the financial sector since January 2025 and requires a register of critical ICT providers and exit clauses; NIS2 extends equivalent obligations to thousands of entities; and since the Schrems II ruling, any transfer outside the EU requires a documented impact assessment, including under the Data Privacy Framework. Large corporate clients and public tenders now reproduce these requirements in technical annexes, long before any regulator steps in.
The good news is that compliance depends less on the provider's flag than on control of the keys and the segmentation of processing. BYOK, HYOK, externalised HSM, confidential computing and application-level encryption make it possible to keep workloads on a hyperscaler while rendering the data unusable without a key that remains under European control. This document provides the criteria to decide which data falls under which model, and how to document that choice.
A Regulatory Landscape Under Strain
Between a revised HDS framework, an EUCS scheme still unfinished and intact US extraterritoriality, teams must decide today on architectures that will be audited tomorrow. Three dynamics explain why the subject can no longer be handled at the end of a project.
The following sections detail what each framework actually covers, how to measure the legal exposure of a workload and which encryption architectures stand up to scrutiny.
HDS Certification: The Real Scope
HDS certification, derived from article L.1111-8 of the French public health code, replaced the former approval scheme in 2018: it is built on an ISO 27001 foundation, supplemented by requirements inspired by ISO 20000-1 and ISO 27018 and by obligations specific to the healthcare sector.
Always ask for the HDS certificate itself, not the logo: check the accredited certification body, the numbers of the activities covered and the appendix listing the certified services. If your SaaS vendor operates the platform, it must hold its own certification for activities 4 to 6 — its IaaS provider's certificate does not cover it.
HDS, SecNumCloud, EUCS: Comparison
HDS, SecNumCloud and EUCS do not answer the same question: the first governs a sector, the second qualifies a level of trust that includes legal criteria, the third aims to harmonise the cybersecurity assessment of cloud services across Europe.
Confusing a "trusted cloud" with an actual qualification: an offering operated in France under licence of a US technology is not qualified until ANSSI has issued the attestation, and no certification, HDS included, exempts you from carrying out the transfer impact assessment required by Chapter V of the GDPR.
Cloud Act and GDPR Transfers
The 2018 CLOUD Act requires any provider subject to US jurisdiction to hand over to the authorities data in its "possession, custody or control", whatever the country where that data is physically stored.
BYOK and HYOK Encryption Architecture
Between encryption at rest enabled by default and exclusive control of the keys, there are three distinct models whose legal guarantees are very unequal.
For each flow, document a single answer: who can decrypt, with which key and under which jurisdiction. It is this table, not the provider's certification level, that will hold up before an auditor or a supervisory authority.
Key takeaways
- Do you have an up-to-date classification of the data you host, distinguishing personal health data, financial data and strategic data?
- Have you obtained and read the HDS certificate of each of your providers, including the certification body, the activities covered and the annex listing the certified services?
- Have you formalised a transfer impact assessment (TIA) documenting each provider's and sub-processor's exposure to an extraterritorial jurisdiction?
- Do you know, for each sensitive workload, who physically holds the encryption keys and where the cryptographic operations are executed?
- Have you tested, under real conditions, the revocation of a key followed by the restoration of the associated service?
- Do you keep an up-to-date list of your providers' sub-processors, together with an exit plan costed in effort and lead time?
