The SREN law: cloud rules in France, from cloud credits to sensitive data

2024-05-21 · Publisher : République française · Domain : Cloud & DevOps

Law No. 2024-449 of 21 May 2024 (SREN) caps migration fees and cloud credits, tasks Arcep with interoperability, and provides that the State hosts its sensitive data in a cloud protected from extraterritorial laws.

### Background Law No. 2024-449 of 21 May 2024 "to secure and regulate the digital space" (SREN) is promulgated. It devotes several articles to the cloud market, aiming to limit lock-in and protect the State's sensitive data. ### Key facts - Article 26: "cloud credits" are limited to one year and can no longer come with exclusivity; fine of 1 million euros, 2 million in case of repeat offence. - Article 27: transfer and migration fees are limited to costs directly linked to switching provider, with a cap set by an Arcep order. - Articles 28 and 29: Arcep defines interoperability and portability specifications; operators publish a technical reference offer. - These portability and fee provisions expire on 12 January 2027, replaced by the European Data Act. - Article 31: the State, its operators and certain public interest groupings must require, for sensitive data, protection against any access by public authorities of third countries (SecNumCloud qualification possible). ### Why it matters The law transposes part of the "cloud at the centre" doctrine into French law and anticipates the Data Act. Article 31 had a delayed effect: its implementing decree, expected at the end of 2024, was only published in April 2026. For providers and IT services firms answering public tenders, this is the text that turns SecNumCloud into a legal requirement rather than a mere recommendation. ### Takeaway The SREN law sets in 2024 the legal framework that makes SecNumCloud binding on the State.

Tags : Réglementation, SecNumCloud, Souveraineté, Cloud souverain, Données