Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Customers select the AWS regions where their content is stored and consent to storage and transfer in those regions. AWS states it will not access, use, or disclose customer content except as required to provide services or comply with law or governmental orders, and will not move content outside selected regions except as legally required. AWS commits to notifying customers of legal requirements or orders unless prohibited by law.
This analysis describes what AWS's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Section 1.4 establishes customer control over content location by region and contractually limits AWS's authority to access or move content outside those regions. The notification commitment for governmental access requests, qualified by legal prohibition, is operationally significant for customers with data residency and compliance obligations under GDPR, CCPA, and sector-specific frameworks.
Under Section 1.4, the agreement states that AWS will not access, use, disclose, or relocate customer content except as required to provide services or comply with law, and will provide notice of governmental access requests unless legally prohibited from doing so. Customers' account information, as distinct from customer content, is governed by the AWS Privacy Notice rather than this section.
Cross-platform context
See how other platforms handle Data Privacy and Content Storage Controls and similar clauses.
Compare across platforms →Monitoring
AWS has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"You may specify the AWS regions in which Your Content will be stored. You consent to the storage of Your Content in, and transfer of Your Content into, the AWS regions you select. We will not access or use Your Content except as necessary to maintain or provide the Services, or as necessary to comply with the law or a binding order of a governmental body. We will not (a) disclose Your Content to any government or third party or (b) move Your Content from the AWS regions selected by you; except in each case as necessary to comply with the law or a binding order of a governmental body. Unless it would violate the law or a binding order of a governmental body, we will give you notice of any legal requirement or order referred to in this Section 1.4.Excerpt from AWS's Customer Agreement
1. REGULATORY LANDSCAPE: Section 1.4 directly engages GDPR Chapter V data transfer requirements, as customer content stored in specified AWS regions may involve cross-border transfers subject to adequacy decisions or standard contractual clauses. CCPA and CPRA apply to California residents' personal data processed through AWS services. HIPAA Business Associate Agreement requirements apply to covered entities and business associates processing protected health information through AWS. The distinction between 'Your Content' and 'Account Information' in this section, with only the latter governed by the Privacy Notice, is material for data mapping purposes. 2. GOVERNANCE EXPOSURE: Medium. The notification commitment for governmental orders is qualified by legal prohibition, meaning customers may not receive advance notice of governmental access to their content in jurisdictions with broad national security or law enforcement access frameworks, including the United States under applicable federal statutes. This creates residual uncertainty for international customers with data localization requirements. 3. JURISDICTION FLAGS: EU and EEA customers should evaluate whether data processing agreements and transfer mechanisms on file with AWS satisfy GDPR requirements, as this agreement alone does not establish the full legal framework for GDPR-compliant processing. UK customers face analogous requirements under UK GDPR. Customers in sectors subject to data residency mandates (financial services, healthcare, government) should confirm that AWS region selection and contractual provisions satisfy sector-specific requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations acting as data controllers should confirm that their AWS Data Processing Addendum or equivalent DPA is in place and current, as this agreement's Section 1.4 operates alongside but does not replace formal data processing agreements required under GDPR and other frameworks. The statement that the Privacy Notice does not apply to customer content is a material distinction that should be reflected in data inventory and mapping documentation. 5. COMPLIANCE CONSIDERATIONS: Legal and compliance teams should confirm that AWS region selections in account configuration match data residency obligations under applicable law and internal data governance policies. The notification carve-out for legally prohibited governmental orders should be factored into incident response planning and customer disclosure obligations. Organizations subject to HIPAA should confirm that an active AWS Business Associate Agreement is in place separate from this customer agreement.
Section 1.4 establishes customer control over content location by region and contractually limits AWS's authority to access or move content outside those regions. The notification commitment for governmental access requests, qualified by legal prohibition, is operationally significant for customers with data residency and compliance obligations under GDPR, CCPA, and sector-specific frameworks.
Under Section 1.4, the agreement states that AWS will not access, use, disclose, or relocate customer content except as required to provide services or comply with law, and will provide notice of governmental access requests unless legally prohibited from doing so. Customers' account information, as distinct from customer content, is governed by the AWS Privacy Notice rather than this section.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS.