GLARS. Geo-Legal Access Risk Score
Worked example

Multi-Jurisdiction Data Journey

One customer record, followed from sign-up to a cross-border demand, and the legal powers that can reach it at each step.

Legal position last reviewed October 2026. Illustrative, not legal advice.

Follow the data.

example.co.uk · illustrative

A UK customer signs up to a .uk service. The company running it is American and stores its data in India. Time runs along the line, from sign-up to a demand for the record; under each stage are the powers that can reach the record at that point. Open any of them to see why it matters there.

  1. 01 · Sign-up

    A UK customer signs up at example.co.uk

    UK

    • Domain suspension

      UK · Medium · Availability

      This can take the service offline at the moment of sign-up, without touching the data. It affects availability rather than access, so it sits outside the core score.

  2. 02 · In transit

    The record crosses international networks

    UK · US · IN

    • Investigatory Powers Act 2016 12

      UK · High · Interception

      Bulk interception warrants can cover communications leaving the UK, so the record can be collected before it reaches India.

      Connects to Five Eyes intelligence sharing (stage 02), UK-US Data Access Agreement (stage 05).

    • Executive Order 12333 3

      US · Medium · Signals intelligence

      The US can collect the record on international networks outside the US, before the US company ever touches it.

      Connects to Five Eyes intelligence sharing (stage 02).

    • Five Eyes intelligence sharing 4

      UK · US · High · Sharing

      Whatever either country collects in transit can end up with the other, so the record is exposed to both through a single interception.

      Connects to Executive Order 12333 (stage 02), Investigatory Powers Act 2016 (stage 02), FISA Section 702 (stage 04).

    • Telecommunications Act 2023 5

      IN · Medium · Interception

      Once the record enters Indian networks it can be intercepted on Indian orders, with review inside the executive rather than by a court.

  3. 03 · At rest

    Stored in an Indian data centre

    IN

    • IT Act 2000, section 69 6

      IN · High · Access and decryption

      The stored record can be monitored or decrypted on government direction, and the hosting provider must help.

      Connects to Conflict of laws (stage 05), Corporate control (stage 05).

    • DPDP Act 2023 7

      IN · Medium · Exemptions

      The data protection law that should protect the record also lets the government exempt itself and call for information.

      Connects to Conflict of laws (stage 05).

    • RBI payment-data rule 8

      IN · Medium · Localisation

      If the record includes payment data it must stay in India, which keeps it within Indian powers and limits where it can be moved.

  4. 04 · In use

    Run by the US operator

    US

    • CLOUD Act 9

      US · High · Compelled disclosure

      Because the operator is a US company, a US order can require it to produce the record held in India.

      Connects to Conflict of laws (stage 05), Corporate control (stage 05), UK-US Data Access Agreement (stage 05).

    • FISA Section 702 1011

      US · High · Targeted collection

      The UK customer is a non-US person, so the US operator can be compelled to help collect their record.

      Connects to Five Eyes intelligence sharing (stage 02).

    • National Security Letters 12

      US · High · Secret demands

      The operator can be ordered to hand over records about the account and be barred from telling the customer.

  5. 05 · On demand

    An agency asks for the record

    UK · US · IN

    • UK-US Data Access Agreement 13

      UK · US · High · Cross-border orders

      A UK agency can serve its order directly on the US operator, without going through the US government.

      Connects to Investigatory Powers Act 2016 (stage 02), CLOUD Act (stage 04).

    • Corporate control

      US → IN · High · Reach through ownership

      Keeping the record in India does not keep it out of US reach: the demand goes to the parent company, which controls the Indian servers.

      Connects to IT Act 2000, section 69 (stage 03), CLOUD Act (stage 04).

    • Conflict of laws

      US · IN · Medium · Conflicting duties

      The operator may face penalties whichever way it decides, and the customer has little say in the outcome.

      Connects to DPDP Act 2023 (stage 03), IT Act 2000, section 69 (stage 03), CLOUD Act (stage 04).

A record stored in India is still within UK and US reach: the networks it crosses and the company that runs it bring in their law at different moments. Domain suspension and the RBI rule are not scored in the core components; they are shown because they affect the data at that stage.

Sources

  1. Investigatory Powers Act 2016
  2. Investigatory Powers (Amendment) Act 2024
  3. Executive Order 12333
  4. The Five Eyes (UK Defence Journal)
  5. Department of Telecommunications: Acts and rules
  6. Information Technology Act 2000
  7. MeitY: Data protection framework
  8. RBI: Storage of payment system data
  9. CLOUD Act (H.R. 4943, in the Consolidated Appropriations Act 2018)
  10. FISA Amendments Act 2008
  11. Reforming Intelligence and Securing America Act 2024
  12. USA PATRIOT Act (expanded NSL powers)
  13. UK-USA Agreement on Access to Electronic Data

Jurisdiction by jurisdiction

UK TLD (.uk domain)

Legal Registration Jurisdiction

A .uk domain places the domain itself under UK law and the UK registry, Nominet. On its own it gives UK authorities no access to data hosted elsewhere, but it signals a UK-facing service, which brings the operator closer to the reach of UK investigatory powers.

UK Government Agencies with Legal Authority

  • GCHQ (Government Communications Headquarters)
  • MI5 (Security Service)
  • Home Office
  • National Crime Agency
Investigatory Powers Act 2016High
Interception, equipment interference and bulk powers, with warrants approved by a Judicial Commissioner. Technical capability notices can require providers to maintain access capabilities. Amended in 2024.
Domain suspensionMedium
Nominet can suspend .uk domains at the request of UK law enforcement, taking the service offline without touching the data itself.

US Corporate Jurisdiction

Service Provider & Corporate Control

The US-based company operating the service creates a powerful secondary jurisdiction through corporate control, regardless of server location.

US Government Agencies with Legal Authority

  • FBI (Federal Bureau of Investigation)
  • NSA (National Security Agency)
  • DOJ (Department of Justice)
  • FISC (Foreign Intelligence Surveillance Court)
  • DHS (Department of Homeland Security)
CLOUD ActHigh
Allows DOJ and FBI to compel US companies to provide data regardless of where it's stored.
FISA Section 702High
Targeting of non-US persons abroad with compelled help from US providers. The statutory authority lapsed in June 2026, but collection continues under court certifications approved in March 2026.
National Security LettersHigh
Enables FBI to issue secret demands for data with gag orders, limiting transparency.
Executive Order 12333Medium
Authorizes NSA signals intelligence collection outside the US, with oversight largely within the executive branch.

India Data Storage

Physical Server Location

Physical data storage in India creates a third legal jurisdiction with its own access powers, regardless of corporate control.

Indian Government Agencies with Legal Authority

  • CERT-In (Indian Computer Emergency Response Team)
  • Intelligence Bureau
  • NATGRID (National Intelligence Grid)
  • Reserve Bank of India
  • Ministry of Electronics and IT
Information Technology ActHigh
Section 69 lets the government direct interception, monitoring or decryption of information by authorised agencies such as the Intelligence Bureau. Intermediaries must assist.
Data Localization RequirementsMedium
The Reserve Bank of India requires payment system data to be stored only in India.
Telecommunications Act 2023Medium
Section 20 and the 2024 interception rules let the Union Home Secretary order interception of messages, reviewed by a committee of senior officials.
Digital Personal Data Protection Act 2023Medium
Rules notified in November 2025 phase in until May 2027. The government can exempt its own agencies on security grounds and require organisations to provide information.

Jurisdiction Interactions

These three jurisdictions don't operate in isolation - they interact in ways that can amplify risk:

UK-US Data Access AgreementHigh
In force since October 2022 under the CLOUD Act. Each country's authorities can serve orders for serious-crime investigations directly on the other's providers.
Five Eyes intelligence sharingHigh
Under the UKUSA arrangements GCHQ and the NSA share signals intelligence, so data collected by one can reach the other.
Corporate Control LeverageHigh
US authorities can compel a US parent company to produce data held by its Indian operations.
Jurisdictional ConflictsMedium
A US order to produce data held in India may conflict with Indian law, leaving the provider unable to comply with both.

GLARS Vector Representation

GLARS:1.0/B:JO:80/AP:80/TR:85/EX:90/TP:75/EI:15/SS:20

Proposed extensions from the roadmap, not yet part of the score: J:UK-US:1.3/J:US-IN:1.1/J:UK-IN:0.9/CC:US/DS:IN/TLD:UK

Open this assessment in the calculator

Risk Assessment Analysis

Base = (80 × 0.20) + (80 × 0.25) + (85 × 0.15) + (90 × 0.25) + (75 × 0.15) = 82.50 GLARS = max(Base 82.50, EI 15, SS 20) = 83

GLARS Score
83/100 High

Each component takes the highest exposure across the three jurisdictions, then the core formula applies. India sets Judicial Oversight and Transparency, the UK Technical Requirements and the US Extraterritoriality; all three score 80 for Agency Powers. On their own the UK scores 67, the US 69 and India 71.

Corporate Impact
US Corporate Control Amplifying

US jurisdiction extends globally through corporate control regardless of data location.

Interaction Effect
UK-US cooperation Amplifying

Under the proposed Jurisdiction Interaction Model, the Data Access Agreement and Five Eyes sharing would raise the score further. This is not yet part of the core score.

Why GLARS Is Essential

This journey shows why traditional single-jurisdiction risk assessment fails in modern cloud environments. GLARS provides:

  • Multi-dimensional analysis
    • Captures TLD, corporate control, and physical hosting jurisdictions. Juri finds these for a real domain or IP address.
  • Jurisdiction interaction modeling
  • Vector notation
    • Enables precise communication of complex risk factors
  • Quantified risk scoring
    • Turns subjective assessments into measurable metrics
  • Decision support
    • Provides actionable insights for architecture and compliance decisions

Without a framework like GLARS, organizations miss critical cross-border legal risks that can lead to compliance failures and data sovereignty challenges.

Ready to analyze your own multi-jurisdiction scenarios?

Apply GLARS methodology to your specific data flows and uncover hidden jurisdictional risks.

Learn About GLARS See the roadmap Check a domain with Juri