What happens to cloud data after a country gets sanctioned?
<p>I am a software developer with almost no knowledge of international laws.
So here is a hypothetical scenario. Let's say, I live in a XYZ country and Google cloud has a data center in my country and I use their service to keep my data in the cloud, in the data center that is present inside my country.</p>
<p>If the USA puts my country on the sanctioned list(or restricts trade), like Iran, then I suppose American companies won't be allowed to do any business with any citizen of my country. In this case, what happens to my data? Since to do any business in my country, a company has to register a local entity, there will be a separate entity that is &quot;Google XYZ&quot;.</p>
<p>Is it legal for &quot;Google XYZ&quot; to continue the operation in my country? Or Since this is a subsidiary or related to Google in the USA, it can't continue the business? (I have no idea how this type of setup works when a company opens a branch in another country)</p>
<p>If it is allowed, I guess I will be able to retrieve my data, but what if it's not technically feasible to retrieve data without going through infrastructure owned by Google in the USA?</p>
<p>If it is not allowed, then what happens to company assets in the sanctioned country? Like some have manufacturing units, some have data centers, and many other kinds of assets.</p>
<p>I am a little worried since I saw how some people in Iran were locked out of Github without any option to export their data. And this case, the majority of cloud providers are American companies, so just wanted to get some clarity.</p>

<p>There is a specific answer about Iran, and a vague general answer. The vague general answer is &quot;It depend on what the sanctions are&quot;. <a href="https://home.treasury.gov/system/files/126/drcongo.pdf" rel="nofollow noreferrer">Here</a> is the summary of the sanctions against DR Congo. The gist of the sanctions is that they are directed against <a href="https://home.treasury.gov/system/files/126/13413.pdf" rel="nofollow noreferrer">7 particular individuals</a>. The prohibited transcations are described as:</p>
<blockquote>
<p>Unless otherwise authorized or exempt, transactions by U.S. persons,
or in or involving the United States, are  prohibited if they involve
transferring, paying, exporting, withdrawing, or otherwise dealing in
the property or  interests in property of an entity or individual
listed on the SDN List.  The property and interests in property of an
entity that is 50 percent or more directly or indirectly owned,
whether individually or in the aggregate, by one or  more persons on
the SDN List are also blocked, regardless of whether the entity itself
is listed.</p>
</blockquote>
<p>In the case of Iran, the sanctions are much broader, but not universal. Bear in mind that a service provider may take an action which is not absolutely mandated by US law, out of an abundance of caution and fear of misinterpreting the law. <a href="https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1611" rel="nofollow noreferrer">Here is a list</a> of computer things that are allowed to flow to Iran. Note the following.</p>
<blockquote>
<p><strong>441. Do the Personal Communications GLs authorize the exportation of fee-based cloud computing services to Iran and Sudan?</strong></p>
<p>Yes. Paragraphs (a)(1) of the Personal Communications GLs authorize
the exportation to Iran and Sudan of fee-based cloud computing
services incident to the exchange of personal communications over the
Internet. In addition, paragraphs (a)(2)(i) and (a)(3) authorize
software necessary to enable such services, provided that such
software is designated EAR99 or classified by the U.S. Department of
Commerce on the CCL under ECCN 5D992.c or, in the case of software
that is not subject to the EAR, would be designated EAR99 if it were
located in the United States or would meet the criteria for
classification under ECCN 5D992.c if it were subject to the EAR.</p>
</blockquote>
<p>Would that cover your interest? (Would you, as a business, take a risk in possibly mis-interpreting this guidance?)</p>
<p>Indeed, <a href="https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/" rel="nofollow noreferrer">Github announced</a> earlier this year that it now has a license to operate in Iran (they don't discuss details what caused the <a href="https://techcrunch.com/2019/07/29/github-ban-sanctioned-countries/" rel="nofollow noreferrer">earlier restrictions</a>, which were not absolute). During that period, some users had access suspended (but not, it is reported, public repositories).</p>

<h2 id="you-lose-it-ttqv">You lose it</h2>
<p>Just like you lose it if your country goes to war with another country.</p>
<p>If you have assets in a foreign country (could be data, could be real estate, could be gold bricks in a bank vault, doesn’t matter) and your country passes a law making it illegal to do business with that country, you can’t get your still until that law is repealed.</p>

sanctions