Nothing to worry about – says new American owner

Imagine you’ve made all the proper moves: you’ve migrated away from big U.S. platforms. Your tools are under EU jurisdiction, locally hosted, and you sleep soundly at night.

Then, surprise, one of your European providers gets acquired by an American company. All the things you migrated away from are suddenly back: foreign jurisdiction, CLOUD act exposure, the whole shebang. But you didn’t make that choice, they made it for you.

Well, it’s not just theoretical. Last November, Kyndryl, an American firm, announced it was acquiring Solvinity, a Dutch cloud provider. The problem: Solvinity runs DigiD, the Dutch national authentication system for citizens. And they also host infrastructure for the Ministry of Justice.

Obviously, that didn’t go down too well in the halls of The Hague, and the Dutch government opened an investigation into it, blocking everything.

The difference between your organisation and the Dutch government is that you probably don’t have the weight to push back and call an emergency debate about it (and, if you do, who are you?).

But, there is one tool you can use. It’s just that most people don’t think to ask or don’t know they can: a change-of-control-clause.

It’s a provision that gives you the right to terminate and move your data out if the ownership of the provider changes. Without one, you’re locked-in to the new owner and their jurisdiction.

Next time you’re signing or renewing a contract, check that you can exit if the company is acquired.

Tip: add a calendar event a couple of weeks before your next renewal so you can check the contract and make sure you don’t end up with defaults that work against you.

Colin