Privacy requirements when using cloud services

Storing personal data in the cloud is permitted, but as an organization, you remain responsible for its secure storage—even if you outsource this to a cloud service. This means: assess the privacy risks in advance, be critical of your cloud provider and the contract, and pay extra attention to storage outside the EU. Below, you can read what to look out for when using cloud services.

Benefits and risks of cloud computing

Cloud computing offers many advantages, and consequently, many companies store data in the cloud — sometimes highly sensitive personal data, for example when a healthcare provider stores health data. You do not necessarily need the consent of the data subjects for this, but you must be aware of the risks. Data can leak, and that can have far-reaching consequences.

Be critical of the cloud service provider

Just like government institutions, organizations must thoroughly assess the privacy risks before engaging a cloud service. Pay attention to the following:

• which security measures the cloud provider takes;
• how the provider handles data breaches;
• whether the security level is adequate for the data you want to place in the cloud.

Be critical of the chosen provider and of both the technical and organizational measures. Document the agreements in a data processing agreement.

Be careful with standard contracts

Many cloud services use standard contracts, but these do not always offer sufficient protection. For instance, provisions regarding access to your personal data if the provider goes bankrupt or the partnership ends are sometimes missing. Are you unsure about the terms of a (standard) contract? Then have a ContractCheck™ performed: we assess the contract against applicable legislation and identify the risks.

Strict rules for cloud storage outside the EU

If personal data is stored with a cloud service provider outside the EU, additional requirements apply. It is not automatically prohibited, but the same level of protection must be guaranteed as within the EU. You must verify for yourself whether this is the case — and often it is not. Specific risks include:

• governments that in some countries can legally gain access to servers and monitor;
• a lower level of security or legal protection than in the EU.

TODO_VERIFY: The rules for transferring personal data to countries outside the EU (such as adequacy decisions and standard contractual clauses) change regularly — check the current situation before storing data outside the EU.

Your responsibility: technical and organizational measures

Whether you store data locally or in the cloud, within or outside the EU, you must always take appropriate technical and organizational security measures. That responsibility lies primarily with you as the controller, not with the cloud provider.

Frequently Asked Questions

Am I allowed to store personal data in the cloud?

Yes, provided you take appropriate security measures, document the agreements (for example, in a data processing agreement), and guarantee an equivalent level of protection when storing outside the EU.

Do I need consent from data subjects for cloud storage?

Not necessarily. For mere storage in the cloud, consent is usually not the legal basis, but you must comply with the other GDPR requirements (such as security and a valid legal basis).

Is a standard cloud service contract sufficient?

Not always. Standard contracts sometimes lack important provisions, for example regarding access to your data in the event of bankruptcy or termination. Have the contract checked.

Who is responsible in the event of a data breach in the cloud?

As the data controller, you remain responsible for data protection, even if you outsource storage. Good agreements with the provider are therefore essential.

Questions about privacy and cloud services?

The safe and lawful use of cloud services requires proper agreements and the right security. We map out your privacy risks, review your cloud contracts, and prepare the necessary documents.

View our expertise in privacy and data protection or schedule a no-obligation consultation.