SREN decree: SecNumCloud becomes mandatory for the State's sensitive data

2026-04-14 · Publisher : République française · Domain : Cloud & DevOps

Decree No. 2026-272 of 14 April 2026 implements article 31 of the SREN law: the State, its operators and six public interest groupings must host their sensitive data with a SecNumCloud or equivalent cloud provider.

### What changes Decree No. 2026-272 of 14 April 2026 finally specifies the conditions for applying **article 31 of the SREN law** of 21 May 2024. It sets out when State administrations, their operators and certain public interest groupings may entrust data of particular sensitivity to a cloud service supplied by a private provider. It comes nearly two years after the law. ### Key facts - Entities concerned: State administrations, their operators and six GIPs, including the digital health agency and the secure data access center. - Data covered: data protected by legal secrecy and data essential to State missions (national security, public order, public health), with a characterized risk if compromised. - Requirement: a SecNumCloud qualification "or equivalent" from ANSSI. - Ten requirement domains, including information security, cryptography, data reversibility, location and protection against unauthorized access by a foreign State, and use of French. - Eighteen-month period for existing non-compliant projects, with ministerial derogations under conditions; ANSSI's security framework remains to be specified. ### Why it matters For providers and IT services firms answering public tenders, this is when SecNumCloud moves from doctrine to a legal obligation, with an eighteen-month migration timeline. Offers qualified or being qualified (S3NS, OVHcloud, NumSpot, Bleu) find a market here; unqualified offers will have to prove an equivalence the decree does not yet define. ### Takeaway The SecNumCloud obligation for the State's sensitive data has been in force since April 2026.

Tags : SecNumCloud, Réglementation, Souveraineté, Cloud souverain, Sécurité