One of the most significant pieces of data legislation has since been enacted the General Data Protection Regulation. Coming fully into force in 2018, it has transformed the way that businesses worldwide handle the personal data of people within the European Union. However, its reach goes well beyond the borders of Europe any organization located anywhere in the world that processes the personal data of someone located in the EU must comply with its requirements or face fines up to €20 million euros or four percent of global annual turnover.
GDPR compliance presents a particular and multifaceted set of challenges for organizations that utilize cloud infrastructure as the primary platform for storing and processing data. Unlike handcrafted environments, clouds are multi-region, have third-party processors under shared responsibility that need to be configured and governed. Knowing how the various cloud data protection capabilities align with GDPR obligations is a prerequisite for any organization that takes its compliance posture seriously.
A foundational starting point for understanding how cloud-based approaches to data protection can support regulatory compliance is the resource on cloud data protection meeting GDPR requirements, which outlines how security and data governance capabilities in the cloud map to the core objectives of protecting personal data.
Personal Data. What Does the GDPR Require from Organizations?
The GDPR lays out seven principles for handling personal data. These principles, lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation and integrity and confidentiality are the four pillars that a standard where all processing activity must comply. Each of these principles reflects capabilities with both technical and organizational implications for managing data in cloud environments.
The regulation also gives individuals a number of enforceable rights in respect of their data, including the right to know what personal information is stored about them and to have inaccurate data rectified and under certain conditions erased (the “Right to Erasure”, or Right to Be Forgotten), as well as the rights to restrict processing and even ask for data portability. All of these rights place operational responsibilities on organizations: systems must be designed to identify particular records, retrieve them in portable formats, and delete them in a systematic and auditable manner.
A comprehensive explanation of how the GDPR defines personal data, the processing activities it covers, and the rights it grants to individuals is available through the GDPR data processing principles guidance published by the European Commission, which provides authoritative context for organizations seeking to understand the regulation’s scope and application.
The Shared Responsibility Model and GDPR accountability
The one most important concept for how to comply with the GDPR in a cloud environment is the shared responsibility model Cloud providers manage to secure the underlying infrastructure of all of the physical data centers, virtualization layers, network fabric and core platform services. That means the organization using the cloud is accountable for everything else that gets built on top of that infrastructure: how data is configured, classified, encrypted, accessed and governed.
This means a controller-processor relationship under the GDPR. Usually, the data controller is the organization that decides why and how personal data is processed. In the above case, the cloud provider serves as a data processor processing data on behalf of and in accordance with documented directions from its controller. The GDPR imposes reciprocal legal obligations on both parties, and this relationship must be formalized in a Data Processing Agreement clearly delineating the duties of each party.
This implies that choosing a cloud provider, in itself, is a compliance decision. Organizations must ensure that their providers have such Data Processing Agreements in place, hold sufficient security certifications and can prove compliance with relevant GDPR transfer obligations. Provider technical capacity is only part of the picture, adequate contractual and governance structures also need to be put in place.
The Principle of Integrity and Confidentiality How Encryption Is Your Compliance Partner in GDPR
The principle of integrity and confidentiality in the GDPR states that personal data must be processed in a manner that ensures appropriate security, including against unauthorized or unlawful processing and against accidental loss, destruction or damage. Encryption is the chief technical mechanism to achieve this in cloud settings.
Data at rest needs to be encrypted using strong, up to date standards such that if the storage media is compromised, then data cannot be compromised. You need to encrypt data in transit with secure transport protocols to stop interception between cloud services, between users and cloud applications, and then from cloud environments back on-premises. Encryption key management needs to be seen as a critical security control in its own right: the process of storing, rotating and controlling access to the cryptographic keys that protect data.
Data Classification as a Prerequisite
GDPR compliance mandates organizations to understand what personal data they store, where it is located, and how it is used. This requires a disciplined data classification regime. That is because personal data in cloud environments can exist between multiple services, regions and applications. Automated data discovery and classification tools enable you to discover personal data at scale, apply sensitivity labels, and enforce controls depending on the type of data discovered (i.e., what regulatory category does the identified personal data belong to).
There are stricter requirements for organizations that process special categories of personal data under the GDPR – such as health information, racial or ethnic origin, religious beliefs and biometric data and enhanced protections must be applied to these categories in all contexts in which they are stored or processed in a cloud environment.
Cloud Geography and Cross-Border Transfers of Data
Article 44 of the GDPR contains strict requirements around transfer of personal data outside the European Economic Area. There can be no transfer of data out to third countries unless there is one of the following: an adequacy decision (the European Commission must have confirmed that the destination country provides a sufficient level of protection), Standard Contractual Clauses (this is where the data exporter and data importer agree to contractual terms), Binding Corporate Rules for intra-group transfers, or other approved safeguard.
For organizations relying on cloud providers with infrastructure and personal data spanning multiple jurisdictions, this necessitates configuring any applicable settings for data residency to keep personally identifiable data within compliant geographies, or to document and enforce appropriate transfer mechanisms. Cloud platforms often provide options to limit organizations on which data regions they can select, determining whether processing or replication can occur in non-approved locations. These settings need to be actively managed and audited frequently.
The jurisdiction of the cloud provider and whether data stored on their infrastructure is subject to law in a non-EEA country that could require them to disclose that data, has grown as an important compliance issue with respect to GDPR transfer requirements.
Access Control, Audit Logging and Accountability
Instead, the GDPR’s principle of accountability suggests that organizations must be able to prove compliance (not simply claim it). Such implications have a direct impact on the way personal data access is governed and logged in cloud environments. Role-based access controls with strong authentication should restrict access to personal data only to those who need it, people or systems. All access events must be recorded in a way that can facilitate an audit.
Audit logs shall be retained for a period sufficient to support regulatory investigations, internal compliance audits, and data subject access requests. They need to be secured from tampering, and must be stored in such a manner that they are both secure and available as needed. These obligations relate not only to live systems but also backup stores, development environments and any storage of personal data in any format.
Further context on what GDPR compliance requires operationally including breach reporting obligations, controller and processor responsibilities, and the scope of data protection assessments, is provided in the GDPR compliance requirements guide published by CSO Online, which offers a practical overview of what organizations must have in place to demonstrate compliance.
Performing Data Protection Impact Assessments in Cloud Environments
Generally speaking, under GDPR, organizations must carry out Data Protection Impact Assessments (DPIA) prior to initiating any processing activities that are likely to result in high risk to an individual(s) rights and freedoms. These could be for example deploying a new cloud service that processes personal data, moving of personal data to a new platform or working with other AI or analytics systems doing individual-level profiling.
It still requires a Data Protection Impact Assessment to record the nature and purposes of the processing, assess risks to data subjects, identify measures being taken by the controller to mitigate those risks and log the process adopted by them in reaching their decision. In cloud contexts, this evaluation will need to take into account the security controls offered by the provider; whether data is at rest and in transit; what access controls are in place; and through contract what controller-processor relationship exists.
Frequently Asked Questions
Is your company outside the scope of GDPR?
Yes. The start point in understanding how the GDPR applies to your organization is indeed that it applies to any organization, anywhere in the world, that processes personal data about individuals sitting in a country within the eu. Any company is subject to the GDPR if it offers goods or services to EU residents or monitors their behavior, whether the company is based in the United States, Asia, or elsewhere in the world. That extraterritorial reach means that any cloud infrastructure processing EU personal data wherever it is located must comply with the GDPR.
What is a Data Processing Agreement and why do you need it?
A Data processing agreement is a legally binding contract between data controller and data processor on how personal data will be processed, What security measures will follow under the GDPR, what the obligations of both parties are, and other necessary details about functions offered by processors. You will need it whenever an organization works with a cloud provider or other third party to process personal data on its behalf. The organization is not in compliance with its GDPR obligations without a valid Data Processing Agreement, regardless of the security mechanisms the provider maintains.
How fast should a data breach be reported and what is considered a personal data breach under GDPR.
A personal data breach is a security incident that is access to the sensitive OR unlawful destruction loss, alteration of or unauthorized disclosure of or access to personal data. In case of a breach likely to result in a risk to individuals’ rights and freedoms, organizations are required by the GDPR to notify the relevant supervisory authority without delay and, where feasible, not later than 72 hours after having become aware of the personal data breach. Where the breach is likely to result in a high risk, individuals must also be informed at the earliest opportunity. This 72-hour window means that you need to configure your cloud environments in such a way that your breach detection and notification workflows can meet this requirement.