Cloud computing is the provision of IT resources such as storage, computing power or software over the internet by an external provider.
Data protection classification
Where a cloud provider processes personal data on behalf of a customer, this is generally processing on behalf of a controller. A data processing agreement is then required, and the customer must check whether the provider offers sufficient guarantees of data security.
Responsibility for the lawfulness of the processing remains with the customer. The provider's certifications and audit reports make it easier to provide evidence.
Third-country aspects
If the provider or a sub-processor is based outside the EU or the EEA, or if access from there is possible, the rules on third-country transfers also apply. For US providers, it is particularly important whether they are certified under the EU-U.S. Data Privacy Framework or whether standard contractual clauses are used.
Legal provisions
- Art. 28 GDPR
- Processing on behalf of a controller and contractual obligations.
- Art. 32 GDPR
- Security of processing.
- Arts. 44 to 46 GDPR
- Conditions for transfers to third countries.
Related terms.
Third-country transfer / international data transfer A third-country transfer is the transfer of personal data to a recipient in a state outside the EU and the EEA or to an international organisation. Arts. 44 to 46 GDPR Encryption Encryption is the conversion of data by means of a key into a form that can only be read again with the matching key. Art. 32(1)(a) GDPR Schrems II Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid. CJEU, C-311/18 