Cloud Computing and Data Protection

In the recent years, the concept of cloud computing has advanced dramatically. Cloud Computing is gaining traction due to significant investments in cloud around the world. Earlier, data was stored internally within the company itself, as there were no other options for external data storage. Data was then stored on computers owned by a third parties, outside the business setting, in data centres, which are outsourced services. These services had multiple servers, which allowed them to store large amounts of data, including the data of their customers. The storage service has progressed significantly over the years, allowing us to store crucial corporate documents and data in the cloud. Corporate entities and organizations such as Amazon, Google, and Microsoft provide such cloud hosting services.

Hence, cloud computing can be defined as a service provided by a company to client companies upon a contract, regarding services such as storage, back-up, etc enabling the client to have remotely secure access from any place, time, through any device.

Cloud computing is a technology that is being widely integrated by various entities worldwide. It is an efficient tool for companies to achieve greater productivity, reduced operational costs and higher data processing power. Cloud computing also enables IT firms to store and process huge amounts of data remotely. Data can be extracted at any time and from any location whenever it is needed by using any device by simply signing in to User IDs. Cloud service providers provide a variety of services, including file storage, backups as well as software updates and support.

As we know, cloud computing requires transmission of data over computers located all over the globe. But transferring data into countries with stringent data privacy regulations raises potential concerns. Businesses should be prudent while entering in to cloud service agreements and ensure that they contain important terms and obligations of each of the parties. It is advisable to conduct a thorough review on contract clauses including sensitive personal data or business intelligence. Typically, the organisation which transfers their data to a cloud service provider is the Data Controller and the cloud service provider is the Processor. Under the EU GDPR, the Controller determines the means and purposes of processing personal data and the processor processes the data on behalf of the Controller. Here are some essential clauses pertaining to sensitive data and its privacy that need to be included in a Cloud Hosting Service Agreements –

1. Customer Data

Cloud service agreements should include clauses which stipulate certain purposes for which the cloud provider may use customer data. The cloud providers might state that it utilizes customer data which is necessary to operate the services provided or to enhance the Provider’s products. Customers should review and assess the terms contemplated by their cloud provider’s agreement. After a careful appraisal of these clauses, they should consider whether to ask for detailed limitations with regards to using their sensitive data.

In many cloud service agreements, the cloud provider may reveal client data stored in the cloud in response to a lawsuit or other legal orders. Hence, it is pertinent to include a clause in the agreement which requires the cloud provider to inform the customers of such requirements before making a disclosure.

2. Compliance with Data Protection Laws and Data Security

The Cloud Service Provider’s use of client data and the security and confidentiality of the client’s data is very crucial in a cloud computing agreement. The security and privacy of data stored in the cloud should be mandatory in all contracts for cloud computing, because if there is no contractual clause, the supplier could sell this unprotected data. Hence, the clients should be vigilant about specific details in the agreement about data security. Privacy policies should be reviewed by a competent expert in data security. Even though cloud data storage is supposed to be secure, data should always be stored in an encrypted form.

3. Adhering to location-specific Data Privacy laws

Personal Data of the controller can be stored in multiple locations in a cloud storage. With the privacy laws changing from country to country, serious data protection and privacy concerns may arise over the storage and processing locations. It is hence important to include a data protection clause which specifies the jurisdiction and choice of law which will govern any future disputes that may arise. For instance, if the cloud provider transfers personal data to a server located in India, the data will be governed by the law of India unless there is a clause specifying the law which should govern any dispute arising due to breach of contract. A GDPR centric approach would point out that India is not an adequate country in terms of Data protection and hence appropriate safeguards have to be taken. Controllers need to come up with a global cloud approach to follow data localization laws.

4. Ensuring organisational and technical measures are followed

A Privacy by Design approach needs to be inculcated to secure the data by default. This can be achieved by putting in place appropriate safeguards and technologies to maintain security. Ensure that the cloud service provider adheres to IT Security protocols and requirements.

5. Termination and Secure Deletion of Customer Data Post Termination

Typically, a customer’s right to terminate a cloud service agreement arises when the service provider breaches the contract. Customers have the right to terminate but the providers also need a reasonable notice period or payment as a termination fee. Cloud service agreements should also include clauses for deletion of the customer’s data upon termination of services or contract. The service providers have to comply with specific data protection laws regarding the safe disposal of sensitive personal information after the termination.

Personal data must not be held for longer than necessary for the intended purpose under the GDPR. As a result, retention periods should be specified, and data should be deleted once retention periods have elapsed.

6. Breach Management

Data processing agreements with cloud providers must include breach notification requirements and procedures. A breach incident must be defined in the contract, as well as a mechanism for the cloud service provider to notify the Controller about any breach without unnecessary delay.

7. Backup and disaster recovery

The cloud provider must have a backup plan to avert total loss of data in the case of a breach or a disaster. The SLA (Service Level Agreement) which is attached to the contract, should outline their disaster recovery and backup methods in detail. The SLA should specify if the user is required to set up backup and recovery systems.

Conclusion

The digital world has had a lasting impact on the society at large. Cloud computing and its adoption by business entities is also expanding rapidly. As a result, specialists in information technology and legal departments of large corporations must be technically competent to negotiate and enter into detailed cloud computing contracts. Provisions regarding intellectual property and data encryption, as well as the protection and dependability of the information stored and processed in the cloud are essential clauses in a basic Cloud Computing Contract. Hence, Cloud Computing Contracts must include clauses that protect both parties' interests.

*****