Author: Adrian Ramdat (Director of Training & Consultancy)
February 2026
Almost every investigation today leaves a digital footprint. Emails, messaging apps, cloud storage, and social media accounts can all contain evidence that is critical to solving serious crime.
The problem investigators regularly face is simple but frustrating; the data they need is often stored in a different country from where the offence took place. For years, that disconnect slowed investigations, complicated court processes, and left officers waiting months for evidence.
Two laws were introduced to deal with this reality; the US CLOUD Act and the UK’s Crime (Overseas Production Orders) Act 2019 (COPO). While they come from different legal systems, they are designed to work together and are now central to how cross-border digital evidence is obtained.
At a practical level, these laws allow UK and US investigators to access electronic data held overseas more quickly than traditional routes, while still requiring judicial approval and clear legal safeguards.
The CLOUD Act: what it means in practice
The Clarifying Lawful Overseas Use of Data (CLOUD) Act was passed in the United States in 2018 to bring clarity to digital evidence gathering.
For investigators, it does two important things.
First, it confirms that US authorities can require US-based technology companies to produce data they control, even if that data is physically stored outside the United States. This removed uncertainty about whether overseas data storage could be used to avoid lawful access.
Second, and most relevant for international investigations, the CLOUD Act allows the US to enter into data access agreements with trusted partner countries. These agreements let foreign law enforcement agencies make lawful, direct requests to US service providers, as long as strict standards around the rule of law, privacy, and human rights are met.
Without these agreements, investigators must rely on Mutual Legal Assistance Treaties (MLATs). MLAT requests are often slow, bureaucratic, and poorly suited to time-sensitive investigations involving digital evidence.
COPO: How UK investigators use the framework
The UK’s legal tool for using these international agreements is the Crime (Overseas Production Orders) Act 2019, known as COPO.
COPO allows UK investigators to apply to a UK court for an Overseas Production Order (OPO). An OPO is a court order requiring an overseas service provider, such as a messaging app, cloud platform, or social media company, to disclose specific electronic data needed for a serious criminal investigation.
COPO does not give investigators direct powers on its own. A judge must approve the order, and it can only be used where the UK has a relevant international data access agreement in place.
In practical terms, COPO is the mechanism that allows UK investigators to make use of agreements enabled by the CLOUD Act.
The UK–US Data Access Agreement
The most important link between the two laws is the UK–US Data Access Agreement, which came into force in 2020.
- The CLOUD Act provides the authority for the United States to enter into the agreement.
- COPO provides the authority for UK courts to issue Overseas Production Orders under it.
Once an order is approved by a UK judge, it can be served directly on a US-based service provider. US investigators can make equivalent lawful requests to UK providers under the same framework.
This removes the need for most government-to-government requests and significantly reduces delays in obtaining evidence.
What this looks like in real investigations
Terrorism investigation in the UK
UK police are investigating a suspected terrorist plot. Key evidence, such as encrypted messages and cloud-stored files, is held by a US-based messaging platform.
Under the COPO framework, investigators apply to a UK court for an Overseas Production Order. Once granted, the order can be served directly on the provider, allowing officers to obtain the data far more quickly than waiting months for an MLAT response.
Online child exploitation investigation
A UK investigation into online child sexual abuse identifies accounts hosted by a US cloud provider. Time is critical: victims may still be at risk, and digital evidence can be deleted.
Using COPO, investigators apply for a court-approved Overseas Production Order. Once issued, the provider can be compelled to disclose subscriber information and relevant content swiftly, helping protect victims and secure vital evidence.
US investigation involving UK-held data
US law enforcement is investigating organised crime and needs access to data held by a UK-based service provider.
Under the UK–US agreement, US authorities can make lawful, direct requests to the UK company, rather than routing the request through slow diplomatic channels.
Safeguards investigators need to be aware of
These powers are deliberately limited. Both the CLOUD Act and COPO include safeguards designed to protect privacy and national sovereignty.
What counts as serious crime?
Overseas Production Orders are only available for serious criminal investigations. For the purposes of COPO, serious crime includes offences that:
- Carry a maximum sentence of 12 months’ imprisonment or more.
- Involve terrorism.
- Relate to child sexual exploitation and abuse.
- Concern serious organised crime.
COPO cannot be used for minor offences, regulatory breaches, or low-level criminality. The seriousness threshold is intended to ensure that Overseas Production Orders are used only where the intrusion into privacy is justified and proportionate.
In addition:
- Orders must be approved by a judge.
- Requests must relate to a serious criminal investigation.
- Authorities cannot target citizens or residents of the other country.
- Service providers can challenge orders that conflict with domestic law.
Understanding these limits is essential when planning investigations and managing expectations around what data can be obtained.
Why this matters for investigators
COPO and the CLOUD Act are best understood as two parts of the same system. The CLOUD Act creates the international legal gateway, while COPO gives UK courts the power to authorise access through it.
Together, they reflect the reality that modern crime is digital and global. For investigators, they offer a faster, more workable route to overseas data, provided the legal steps are followed correctly.
For organisations operating at the intersection of investigations, law, and technology, understanding how cross-border data access works in practice is no longer optional. It is a core operational capability.
The Signature Brand Training & Consultancy supports investigative teams and organisations in building practical understanding of legal and regulatory frameworks that affect real-world operations. Our training and consultancy services are designed to turn legal complexity into clear, usable insight.
If you would like to explore how we can support your organisation, we would be delighted to start the conversation. Email us at info@thesignaturebrand.co.uk.
Photo by NASA on Unsplash