Cloud computing

Cloud computing refers to the provision of IT services, such as storage space, computing power or software, over a network, particularly the internet. This enables companies to use IT resources flexibly without having to operate the entire technical infrastructure themselves. Where personal data is processed in this context, the requirements of the General Data Protection Regulation (GDPR) must be complied with.

How does cloud computing work?

In cloud computing, an external service provider, known as a cloud service provider (CSP), makes IT resources available.

Instead of operating their own servers and applications entirely in-house, companies can obtain the services they need over the internet.

Data processing takes place on the cloud provider’s technical infrastructure or on infrastructure operated by other service providers engaged by the cloud provider.

Typical cloud services include:

• Cloud storage: Storing and providing access to files on external servers.
• Cloud software: Using applications made available over the internet.
• Cloud computing power: Providing additional computing capacity for applications and business processes.
• Cloud databases: Storing and managing structured data on external infrastructure.

A key characteristic of cloud computing is the flexible adjustment of available resources to actual requirements.

For example, companies can increase their storage capacity without having to purchase their own servers.

This scalability and the frequent use of consumption-based pricing are among the main advantages of cloud computing.

What data protection requirements apply to cloud computing?

Where personal data is processed through cloud computing, the general requirements of the GDPR apply.

Companies must, in particular, ensure that processing is lawful and that personal data is adequately protected.

The use of external cloud service providers frequently constitutes processing on behalf of a controller under Article 28 GDPR.

This is particularly the case where the cloud provider processes personal data on behalf of and in accordance with the instructions of the company.

In such cases, a data processing agreement (DPA) must be concluded between the company and the cloud provider, meeting the statutory requirements of Article 28 GDPR.

The following points must also be taken into account:

• Legal basis: The processing of personal data must be based on an appropriate legal basis under Article 6 GDPR.
• Purpose limitation: Data may only be processed for specified, explicit and legitimate purposes.
• Data security: Appropriate technical and organisational measures must ensure the protection of the data.
• Monitoring the service provider: The company must assess whether the cloud provider offers sufficient guarantees for GDPR-compliant processing.
• Engagement of further service providers: Where sub-processors are engaged, the requirements of Article 28 GDPR must be met.

Even where data processing is outsourced, the commissioning company generally remains responsible for complying with its data protection obligations.

Using a cloud service provider therefore does not automatically transfer data protection responsibility to that provider.

What risks are associated with the use of cloud services?

Cloud computing offers companies numerous technical and economic advantages. At the same time, outsourcing data processing can give rise to specific data protection risks.

One key risk is that personal data is stored and processed on external systems whose technical infrastructure is not directly accessible to the company.

This gives rise to a number of challenges, including:

• Unauthorised access: Inadequate security measures may allow third parties to access personal data.
• Limited control: In relation to certain security measures, companies may have to rely on information and evidence provided by the cloud provider.
• Engagement of sub-processors: The involvement of additional service providers can make it more difficult to maintain control over data processing.
• Data availability: Technical disruptions or outages at the cloud provider may affect access to important information.
• Unclear processing locations: For cloud services operated internationally, identifying the actual locations where data is processed may involve additional requirements.

Under Article 32 GDPR, controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures may include encryption, access restrictions, data backups and regular security reviews.

Companies should therefore assess the security measures in place and how their effectiveness can be demonstrated before selecting a cloud provider.

What rules apply to international data transfers in cloud computing?

Where personal data is transferred to recipients outside the European Economic Area in the context of cloud computing, the requirements of Articles 44–49 GDPR must be observed in particular.

Such a transfer may, for example, be permissible where the European Commission has adopted an adequacy decision under Article 45 GDPR in respect of the relevant third country.

If no such decision exists, appropriate safeguards under Article 46 GDPR may be used, subject to the statutory requirements. These include, in particular, the European Commission’s Standard Contractual Clauses.

Depending on the third country and the specific processing activities, additional safeguards may be required.

Even where cloud providers operate data centres in Europe, companies should check whether personal data is transferred to recipients in third countries or whether access from such countries is possible.

The decisive factor is therefore not merely the location of the servers, but also which service providers are involved in the processing and which data transfers actually take place.

Practical example: Storing customer data in the cloud

A company intends to manage its customer data, which has previously been stored locally, using an external cloud service.

The cloud provider supplies the required storage infrastructure and carries out the technical processing of the data in accordance with the company’s instructions.

As the service provider processes personal data on behalf of the company, this constitutes processing on behalf of a controller under Article 28 GDPR.

The company must therefore conclude an appropriate data processing agreement with the provider before using the service.

It must also assess whether appropriate technical and organisational measures are in place to protect the customer data.

During its assessment, the company discovers that the cloud provider engages further service providers and that, under certain circumstances, access from a third country is also possible.

The company must therefore additionally assess whether the requirements governing the engagement of sub-processors and, where applicable, international data transfers are met.

The processing may only take place once the relevant data protection requirements have been satisfied.

legal data assessment: Companies should not select cloud services solely on the basis of cost, functionality and technical performance. It is also essential to determine whether the provider enables personal data to be processed in compliance with data protection law. Particularly important considerations include contractual safeguards under Article 28 GDPR, appropriate security measures and an assessment of potential transfers to third countries. Careful selection and regular review of the cloud provider can significantly reduce legal and technical risks.

Legal bases

In particular, Articles 5, 6, 24, 25, 28 and 32 GDPR and, in the case of international data transfers, Articles 44–49 GDPR.