Sensitive data in France: SecNumCloud moves from doctrine to law

On 14 August 2026, France’s Official Journal published the order of 12 August that makes the SecNumCloud 3.2 framework (France · ANSSI) the rule for the State’s data “of particular sensitivity”. It completes Decree No. 2026-272 of 14 April 2026, implementing Article 31 of the SREN Act. Ministries, public operators and public interest groupings that entrust such data to a commercial cloud must now choose a qualified offer, or a European certification recognised as equivalent. For projects already under way: 18 months at most to migrate when a compliant offer exists in France.

For five years, the “trusted cloud” remained a doctrine. It is now a condition of legality for the State. For everyone else, two labels are still confused: HDS and SecNumCloud do not answer the same question.

What is already settled

• Article 31 of the SREN Act (France · Parliament): Law No. 2024-449 of 21 May 2024 requires the State to protect its most sensitive data against access by non-European authorities.
• Decree No. 2026-272 (France · Prime Minister) of 14 April 2026: it covers State administrations, their operators, the Health Data Hub and six other public interest groupings, including the Digital Health Agency and the GIP for the modernisation of social declarations.
• Order of 12 August 2026 (France · Prime Minister): it approves the SecNumCloud 3.2 framework; proof comes from an ANSSI qualification or an EU or EEA certification that the agency recognises as equivalent.
• “Cloud at the centre” doctrine (France · DINUM): circular of 5 July 2021, replaced by that of 31 May 2023. Cloud is the default, and particularly sensitive data requires a qualified offer, “immune to any unauthorised access by public authorities of third countries”.
• New HDS framework (France · Ministry of Health): order of 26 April 2024, published on 16 May 2024, applicable to new certifications since 16 November 2024. Data must be hosted exclusively in the EEA; the host informs its clients of possible access from third countries and publishes a map of its transfers. Hosts already certified had until 16 May 2026 to comply.
• Decree No. 2026-209 (France · Prime Minister) of 24 March 2026, implementing Article 32 of the SREN Act: since late September 2026, the Public Health Code itself requires health data to be stored in the EU or the EEA. Remote access from a third country remains possible, under an adequacy decision or with the GDPR’s appropriate safeguards; the contract must then list the applicable non-European laws and the residual risks.
• SecNumCloud-qualified offers (France · ANSSI, according to providers), among others: Outscale (version 3.2 since December 2023), Cloud Temple, OVHcloud (three offers, including its public cloud on 1 September 2026), Orange Business (July 2025, then a second offer announced on 7 October 2026), S3NS, a Thales subsidiary built on Google technology (17 December 2025), and NumSpot for its infrastructure offer (September 2026).

What is still in progress

• Bleu (France · Capgemini and Orange, Microsoft technology): J0 milestone passed in April 2025, J1 in November 2025; qualification is targeted for the end of 2026, according to the specialist press in October. Around a hundred Azure services are in scope; Microsoft 365 will follow.
• Derogations (France · Prime Minister): where no compliant offer exists in France, one year, renewable; all decisions are public.
• Local authorities (France · National Assembly): the decree does not cover them. A private member’s bill would extend the obligation to regions, departments, municipalities and inter-municipal bodies of more than 30,000 inhabitants; passed by the Senate on 17 December 2025 and by the National Assembly’s law committee on 25 February 2026, it had still not been debated in plenary as of 2 November 2026.
• HDS framework 2.1 (France · ANS): it is to translate the March 2026 decree into certification requirements. The agency announced publication in October 2026, with application three months later; as of 2 November 2026, we have found no trace of its publication.
• The European level (EU · European Commission and ENISA): in March 2026, according to ANSSI, negotiations on an EUCS level equivalent to SecNumCloud had not concluded; we return to this on 20 November.

The real issue: qualifying a service, not a provider

A provider’s name proves nothing. OVHcloud has three qualified offers within a much wider catalogue; NumSpot is qualified for infrastructure, not yet for its application platform. Qualification covers a specific service, in specific data centres, and that scope is what the contract must spell out.

Timing matters just as much. S3NS took 17 months between the acceptance of its application (J0 milestone) and its qualification; Bleu is past 18 months. A public project counting on a future qualification therefore takes a scheduling risk, while the migration deadline is capped.

Three points to watch

1. HDS is not SecNumCloud. HDS certification (Article L. 1111-8 of the Public Health Code) guarantees secure hosting, storage within the EU or the EEA and transparency about non-European access. It does not prohibit such access, provided the GDPR framework is met. For the Health Data Hub, which the law names explicitly, hosting must meet both.

2. Sensitive data contaminates its infrastructure. According to the State’s guidance, if part of a system’s data meets the criteria, all data on the same infrastructure falls into scope, unless effectively partitioned. Public servants’ payroll is in scope; the land register is not.

3. Derogations come to an end. A project started before the decree with a non-compliant provider has 18 months at most if a compliant offer exists in France. For a large system, that barely covers a tender and a migration.

What an organisation should do

1. Classify data system by system, using the guidance’s two cumulative criteria: particular sensitivity, and serious harm in case of a breach.
2. List current cloud contracts: offer, qualification, data centres, end date, and any need for a derogation.
3. Require the qualified scope in writing: ANSSI security visa, list of services and sites covered.
4. Check the HDS certificate of every health data host against the 2024 framework, with its map of transfers outside the EEA, and the contract updated since the March 2026 decree.
5. Plan a fallback if the chosen offer is not yet qualified on the signature date.
6. Write reversibility into the contract: exit terms, data export, resources provisioned from the start, as the doctrine requires.
7. Track the two pending texts: the extension to local authorities and the European scheme.

A label is checked down to its scope: the provider’s name is not enough.

The question to ask on Monday morning

To your CIO: “For each of our sensitive applications, which exact service is qualified, in which data centre, and when does our derogation end?”