GDPR And The Cloud – Helpful DPC Guidance For Organisations

Are you a controller of personal data under the General Data Protection Regulation ("GDPR") who uses a cloud services provider ("CSP"), or are you a CSP who acts as a processor to a controller customer who has engaged you to provide it with cloud computing services ("CCS")?

If you answered yes to either question, you are required to be aware of the data protection risks associated with the provision and receipt of CCS and to comply with GDPR obligations appropriate to your status as controller or processor of personal data. Helpfully, the Data Protection Commission ("DPC") has issued a CCS guidance note dated October 2019: "Guidance for Organisations Engaging Cloud Service Providers" which is a useful addition to the range of advice issued by the DPC and provides useful clarification for both customers and suppliers of CCS.