The Cloud Act applies to cloud service providers subject to U.S. law. This means that subsidiaries of US companies are also covered by the law. This also means that you need to know who the subcontractors are.
Carry out impact assessments
The Cloud Act would violate other privacy laws, such as banking secrecy.
Encrypt and pseudonymize
Find out what options are available to use encryption and examine how the provider works with key management – are there opportunities to store encryption keys outside the cloud that make it harder for parties to read the data?