GDPR and Cloud Storage: A Practical Compliance Guide for Businesses

Table of Contents

1. Start with the roles: controller and processor
2. Lawful basis for storing personal data
3. Data processing agreements
4. Data residency and where data is processed
5. International transfers
6. Security of processing
7. Breach notification
8. Retention and storage limitation
9. Subject access and other individual rights
10. Practical steps for major cloud providers
11. A GDPR checklist for cloud storage
12. Frequently Asked Questions

Start with the roles: controller and processor

Under Article 4 of the GDPR, a controller is the entity that determines the purposes and means of processing personal data. A processor processes personal data on behalf of the controller. When your business stores customer records, employee files or contract documents in cloud storage, you are usually the controller for that data, and the cloud provider is usually your processor.

The EDPB's Guidelines 07/2020 on the concepts of controller and processor explain that these roles are determined by facts rather than by contract labels. A provider that uses your data for its own purposes, such as product development or advertising, may be a controller for that processing, which changes your obligations. Read the vendor's terms with this in mind.

Some cloud providers offer data processing terms in which they act as processor for customer content and as controller for limited account and service data, such as billing or service telemetry. That split is normal, but you should understand it and document it.

Lawful basis for storing personal data

Every processing activity needs a lawful basis under Article 6. Storing personal data in cloud storage is a processing activity. The GDPR does not contain a special lawful basis for "cloud storage." The basis depends on why you hold the data in the first place.

For example, employee contract files may be processed to perform an employment contract or to comply with a legal obligation. Customer order records may be processed to perform a contract. Marketing lists may depend on consent or legitimate interests, with the balancing and transparency requirements that apply to each. Storing data in a cloud platform does not create a new basis, and it does not remove the need for one.

A practical step is to add a column to your record of processing activities under Article 30 that names the storage location. If a shared drive holds personal data, that drive should appear in your record with its purpose, its lawful basis and the categories of individuals it covers.

Be careful about storing data "just in case." Article 5(1)(c) requires that personal data be adequate, relevant and limited to what is necessary. A general archive of everything your business has ever received is hard to justify under this principle.

Data processing agreements

Article 28 sets out what must be in a contract between a controller and a processor. Among other requirements, the contract must set out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of individuals, and the controller's obligations and rights. Article 28(3) lists specific terms, including that the processor processes data only on documented instructions, ensures confidentiality of personnel, applies appropriate security measures, assists with individuals' rights and with security and breach obligations, deletes or returns data at the end of the service, and makes information available to demonstrate compliance.

Sub-processors matter too. Under Article 28(2), a processor may not engage another processor without the controller's prior specific or general written authorization, and under Article 28(4) the same data protection obligations must be imposed on that sub-processor. For cloud storage, this means you should know which companies the provider uses for hosting, support, backups and any analytics that touch your data.

In practice, most major cloud productivity providers publish a standard data processing addendum that you accept through your admin console or account terms. Do not assume it is sufficient for your case. Check that it covers the processing you actually do, that it reflects your sector obligations, and that it is the current version. Keep a dated copy in your compliance file.

Data residency and where data is processed

The GDPR does not require personal data to be stored in the EU. It does require you to know where data is processed and to ensure that the rules apply wherever it goes. Residency options offered by cloud providers can help you meet internal policies, customer requirements or prudence, but they do not replace the transfer analysis covered below.

When you assess residency, ask the provider in writing what each of the following covers: primary storage, backups, replication, disaster recovery, support access, telemetry and sub-processors. A storage region setting may cover only primary storage. Your record of processing should reflect the answers.

International transfers

Chapter V of the GDPR, Articles 44 to 49, governs transfers of personal data to third countries or international organizations. Transfers are permitted when one of the mechanisms in that chapter applies.

Adequacy decisions. Under Article 45, the European Commission can decide that a third country provides an adequate level of protection. Where an adequacy decision applies, transfers to that country can take place without further transfer tools. The Commission's adequacy decisions page lists current decisions. Adequacy decisions can be reviewed or invalidated, so check their status before you rely on them.

Appropriate safeguards. Under Article 46, transfers can rely on safeguards such as standard contractual clauses adopted by the Commission. The Commission's standard contractual clauses page describes the current clauses and their use. Standard contractual clauses must be assessed in context, not only signed.

Transfer risk assessment. The Court of Justice of the European Union's judgment in Case C-311/18 (Schrems II) confirmed that controllers relying on standard clauses must assess whether the law of the recipient country affords protection essentially equivalent to EU law, and adopt supplementary measures where needed. The EDPB's Recommendations 01/2020 on supplementary measures set out a step-by-step approach to this assessment, including mapping transfers, identifying the transfer tool and assessing the law and practice of the destination country.

For a small business, a practical approach is to record every cloud service that involves personal data, identify where the provider's processing takes place, identify the transfer mechanism that applies, and keep the assessment on file. Where the data is sensitive, consider whether a European storage region, a European sub-processor arrangement or encryption with controlled keys reduces the risk. Each of these choices has costs and trade-offs, so document the decision.

Security of processing

Article 32 requires controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The GDPR does not prescribe specific tools. It expects you to consider the state of the art, costs, the nature and scope of processing and the risks to individuals.

For cloud storage, appropriate measures typically include multi-factor authentication, least-privilege access to folders containing personal data, restricted external sharing, logging of administrative and access events, endpoint protection on devices that sync, and tested recovery processes. Article 25, on data protection by design and by default, expects these choices to be built into the system rather than added after an incident.

Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to individuals' rights and freedoms, for example where large volumes of sensitive data are processed or where new technologies are used. A decision to move a large archive of personal data into a new cloud platform may warrant a DPIA. Consult your DPO.

Breach notification

Article 33 requires the controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. Where a breach is likely to result in a high risk, Article 34 requires communication to the affected individuals without undue delay.

Article 33(2) requires a processor to notify the controller without undue delay after becoming aware of a breach. This is why the processor agreement's breach clauses matter. You need to know how quickly the provider will notify you, through which channel, and what information it will supply.

Practical steps:

• Build your incident response plan so that a cloud storage incident is covered, including exposure from misconfigured sharing and compromised accounts.
• Record the time you became aware of a breach, since the 72-hour period begins then.
• Keep a template for supervisory authority notifications that includes the nature of the breach, categories and approximate numbers of individuals and records, likely consequences and measures taken.
• Document decisions not to notify, with reasons, as Article 33(5) requires documentation of all breaches.

Retention and storage limitation

Article 5(1)(e) requires that personal data be kept in a form that permits identification of individuals for no longer than is necessary for the purposes for which it is processed. Cloud storage makes it easy to keep data indefinitely, which is a compliance risk in itself.

Build a retention schedule that lists each category of personal data, the purpose, the retention period and the trigger for deletion. Apply it through folder structures, retention policies and deletion processes rather than relying on staff memory. Remember that backups and version history may keep copies after the primary file is deleted. Your schedule should address those copies, and you should confirm the vendor's retention windows for deleted files.

Where a legal obligation requires retention, such as accounting records, the retention period follows that obligation rather than the general principle. Where litigation or an investigation is anticipated, legal hold procedures may require preserving data beyond the schedule.

Subject access and other individual rights

Individuals have rights under Chapter III of the GDPR, including the right of access under Article 15, the right to rectification under Article 16, the right to erasure under Article 17 and the right to restriction of processing under Article 18. Responses are generally due within one month of receipt, subject to extension in complex cases under Article 12(3).

Cloud storage complicates these requests because personal data can be spread across folders, shared drives, personal sync folders, chat attachments and backups. A subject access request requires you to find the relevant data, not only the files you know about. Plan a search procedure that uses your platform's search and audit capabilities, and keep a log of the steps taken.

For erasure, consider whether the data is held in folders you can delete from, whether links to it are still active, and whether copies exist in backups that you cannot selectively edit. Your response should explain what you did and why, and it should not claim capabilities you do not have.

Practical steps for major cloud providers

The specific names of data processing terms, settings and admin menus change over time, so the following describes what to do rather than where to click.

Google Workspace. Review the Google Cloud data processing terms that apply to your Workspace agreement, and confirm you have accepted them through your administrator account. Check the Google compliance resources for current audit reports and sub-processor information. Where residency is required, confirm whether the data regions option is available on your edition and what it covers. Configure sharing defaults, audit logging and retention features that match your schedule.

Microsoft 365 and OneDrive. Review Microsoft's Product Terms and the Microsoft Data Protection Addendum that apply to your agreement. Microsoft publishes GDPR-related guidance on its GDPR compliance pages. Check the Service Trust Portal for audit reports and sub-processor lists. Use retention and eDiscovery features to support schedules and subject access requests, and consider Multi-Geo or other residency options where required.

Dropbox Business. Review Dropbox's data processing terms and confirm acceptance for your business account. Check Dropbox's security and trust resources for audit reports and encryption information. Confirm regional storage options for your plan, and verify how team admin roles, retention and deletion settings apply to your data.

For each provider, record the version of the terms you accepted, the date, the people responsible for them and the review date. Contract terms and sub-processor lists change, and you need to notice when they do.

A GDPR checklist for cloud storage

• Record every cloud storage location containing personal data in your record of processing.
• Document the lawful basis for each category of personal data stored.
• Confirm the processor agreement is in place, is current and covers your processing.
• Obtain a sub-processor list and check for changes.
• Document where data is stored and processed, including backups and support access.
• For transfers outside the EEA, identify the mechanism (adequacy, standard clauses or another Article 46 safeguard) and document a transfer assessment.
• Apply multi-factor authentication and least-privilege access to folders containing personal data.
• Restrict external sharing and review existing links.
• Confirm the provider's breach notification terms and test your internal escalation.
• Apply a written retention schedule, including backup and version history.
• Test a subject access search across your cloud storage.
• Consider a DPIA for large-scale or sensitive processing and consult your DPO.
• Review all of the above at least annually, and after any major platform change.