GDPR cloud computing: how to use cloud services lawfully
GDPR cloud computing comes down to three things: the data processing agreement, the full sub-processor chain and lawful third-country transfers. See what regulators expect, and what the Latombe ruling and the DPF mean for you in 2026.
Email, HR, CRM, file storage and backup now run in the cloud for most European organisations, each on a chain of suppliers you rarely see. The question is no longer whether you can use the cloud under GDPR. It is whether you can show, on request, that you use it lawfully.
That has become harder to answer in the past year. The EU General Court upheld the EU-US Data Privacy Framework in Latombe on 3 September 2025, but the ruling is under appeal. On 29 June 2026 the US Supreme Court decided Trump v. Slaughter, and a month later the European Data Protection Board asked the European Commission to assess what the ruling means for the framework.
This guide to GDPR cloud computing covers what compliance teams need to control: roles, the data processing agreement, sub-processors, international transfers, security and exit.
The short answer: can you use cloud computing under GDPR?
Yes. GDPR does not ban the cloud, and it does not require data to stay in the EU. You need to be able to show three things. A data processing agreement under Article 28 GDPR that also covers the provider's sub-processors. A transfer mechanism under Chapter V for any processing outside the EU/EEA, including remote support access. And security that is appropriate to the risk under Article 32. For US providers, the Data Privacy Framework remains usable as of September 2026 if the recipient is certified. Keep a fallback ready, because the framework is under pressure.
Three questions that often get mixed up
Asking whether a cloud provider is "GDPR compliant" bundles three separate legal questions. A yes to one is not a yes to the others.
| Question | Legal basis | What it settles | What it does not settle |
|---|---|---|---|
| May the provider process data for us? | Art. 28 (processor contract), Art. 24 (controller responsibility) | Instructions, confidentiality, sub-processors, audits, deletion | Whether data may leave the EU/EEA |
| May data be processed outside the EU/EEA? | Chapter V, Arts. 44 to 49 | Transfer tool: adequacy, SCCs, BCRs or a derogation | Whether security is sufficient |
| Is security appropriate? | Art. 32 and Art. 25 | Access control, encryption, logging, backup, testing | Whether processing has a lawful basis under Art. 6 |
An ISO 27001 certificate or a SOC 2 report from the provider speaks to the third question, not the first two. And "we host in the EU" only answers part of the second.
Roles in cloud computing: controller, processor and sub-processor
In most cloud contracts your organisation is the controller and the provider is a processor. You decide the purposes and means, and accountability stays with you even when the provider runs the whole stack.
Articles 32 and 44 bind both parties independently. The Danish supervisory authority, Datatilsynet, puts the practical consequence plainly in its guidance on the use of cloud: where the processor provides the infrastructure, the controller's job is to satisfy itself, and be able to demonstrate, that the processor has done its part.
Watch for providers that also use your data for their own purposes, such as product improvement or analytics. For that part the provider acts as a controller in its own right. The data processing agreement does not cover it, and you need a lawful basis for disclosing the data.
The data processing agreement with your cloud provider
Article 28(3) sets the minimum content of a data processing agreement. With the large GDPR cloud providers you will rarely negotiate the text. You accept a standard DPA as part of the terms. That is acceptable if the terms meet the requirements you should set as controller. If not, choose another service.
Use the table as a checklist.
| Requirement | Provision | What to look for in cloud terms |
|---|---|---|
| Processing only on instructions | Art. 28(3)(a) | What counts as an instruction, any reserved "own purposes", and how the provider handles disclosure demands from non-EU authorities |
| Confidentiality | Art. 28(3)(b) | Confidentiality duties for staff and support personnel |
| Security | Art. 28(3)(c), Art. 32 | A concrete description of measures, not just "industry standard" |
| Sub-processors | Art. 28(2), 28(3)(d), 28(4) | A list with names and locations, advance notice of changes and a real right to object |
| Assistance with rights and breaches | Art. 28(3)(e) and (f) | Breach notice times that leave room for your 72-hour deadline towards the supervisory authority |
| Deletion or return | Art. 28(3)(g) | Export format, deadline and confirmation of deletion on exit |
| Information and audits | Art. 28(3)(h) | Access to assurance reports (ISAE 3000, SOC 2, ISO 27001) and whether they cover the services you actually use |
A data processing agreement is only needed with processors. A partner that is a controller for its own processing does not need one, but you still need a basis for disclosing the data and, where relevant, a joint controller arrangement under Article 26.
Sub-processors: the whole chain is your responsibility
The supply chain is where cloud computing and GDPR most often part ways. A SaaS product typically sits on a hosting provider, an email or SMS delivery service, a support tool and increasingly an AI service. Under Article 28(2), the processor may only engage sub-processors with your prior written authorisation, either specific or general. Under a general authorisation, the processor must notify you of changes so you can object. Under Article 28(4), every sub-processor must be bound by the same data protection obligations as your contract.
How far down the chain does your responsibility reach? The EDPB answered that in Opinion 22/2024, adopted on 9 October 2024 at the request of the Danish authority:
- You must have information on the identity of all processors and sub-processors readily available at all times, meaning name, address and contact person. This applies whatever the risk level.
- You carry final responsibility for verifying that sub-processors provide sufficient guarantees. How deeply you verify depends on the risk.
- Where a sub-processor transfers data outside the EEA on your instructions, your Article 28(1) duties still apply. You must be able to document that the transfer is lawful.
The opinion is already being enforced. On 29 January 2026 Datatilsynet issued a decision against 51 Danish municipalities over their use of Google Workspace for Education in schools. It found breaches of Articles 5(2), 24 and 28(1) and (4) in how they handled the sub-processor chain. It also warned that products with unclear processing structures cannot lawfully be used.
If a cloud provider cannot give you a complete, current sub-processor list, you have a documentation problem. Our guide to auditing data processors shows how to build the ongoing checks.
Third-country transfers in cloud computing
Chapter V applies when personal data is transferred to a country outside the EU/EEA. The general principle in Article 44 is that the level of protection must not be undermined, including for onward transfers. We cover the mechanisms in depth in our article on third-country transfers. Here we focus on what is specific to the cloud.
EU hosting is not the same as no transfer
EU data residency is a good starting point, but it does not settle everything. The EDPB's Guidelines 05/2021, finalised in February 2023, confirm that making data available to an entity in a third country, including by remote access, is a transfer. Datatilsynet goes further in its cloud Q&A: read-only access is processing, and IP filtering does not remove the transfer issue if the provider can still reach the data from outside the EEA through support, maintenance or add-on services.
A US provider can be subject to the CLOUD Act and to FISA Section 702 even when the data sits in Frankfurt or Dublin. The Danish authority accepts using a US provider with EU-hosted data, but only once you have assessed the risk to data subjects and are satisfied that the provider will comply with EU law.
The transfer tools
| Tool | Provision | Typical cloud use | TIA needed? |
|---|---|---|---|
| Adequacy decision | Art. 45 | DPF-certified US providers, the UK (renewed 19 December 2025, valid until 27 December 2031), Switzerland, Japan | No |
| Standard contractual clauses | Art. 46(2)(c), Decision (EU) 2021/914 | Sub-processors in non-adequate countries, non-certified US recipients | Yes |
| Binding corporate rules | Art. 47 | Intra-group transfers, for example a provider's own support centres | Yes |
| Derogations | Art. 49 | Occasional, non-repetitive transfers only. Not suited to running a cloud service | No, but read narrowly |
A transfer impact assessment (TIA) is the assessment the Court of Justice required in Schrems II (C-311/18) on 16 July 2020. You assess whether law and practice in the destination country let the importer comply with the SCCs, and whether supplementary measures are needed. The EDPB's Recommendations 01/2020 set out the method in six steps. Where the importer is subject to FISA 702, clear-text transfers to the US are very hard to justify without supplementary measures.
GDPR cloud computing and the US: the Data Privacy Framework after Latombe
The European Commission adopted the adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023, Implementing Decision (EU) 2023/1795. Transfers to a US organisation certified under the DPF need neither SCCs nor a TIA. For UK exporters, the UK Extension to the DPF has applied since 12 October 2023 under UK GDPR.
The timeline you need to know
| Date | Event | What it means for you |
|---|---|---|
| 16 July 2020 | Schrems II (C-311/18) strikes down Privacy Shield | SCCs need a case-by-case assessment of the destination country |
| 10 July 2023 | DPF adequacy decision adopted | Certified recipients can be used without SCCs or a TIA |
| 9 October 2024 | Commission's first periodic review (COM(2024) 451) | More than 2,800 certified organisations by July 2024. Next review after three years |
| 3 September 2025 | General Court dismisses Latombe (T-553/23) | DPF upheld at first instance |
| 31 October 2025 | Latombe appeals to the Court of Justice (C-703/25 P) | Final word pending. No judgment as of September 2026 |
| 29 June 2026 | US Supreme Court decides Trump v. Slaughter | The President may remove FTC commissioners without cause. FTC independence featured in the DPF decision |
| 31 July 2026 | EDPB asks the Commission to assess the impact on the DPF | No public Commission response yet |
What the Latombe judgment decided
French MP Philippe Latombe argued that the US redress body, the Data Protection Review Court (DPRC), is not independent, and that US intelligence agencies can collect data in bulk without prior court authorisation. The General Court rejected both in its judgment of 3 September 2025. DPRC judges can only be dismissed by the Attorney General and only for cause. And Schrems II does not require prior authorisation of bulk collection, only ex post judicial review, which the DPRC provides.
This is a first-instance ruling, and the appeal in C-703/25 P is pending. The adequacy decision applies until the Commission repeals it or the Court of Justice declares it invalid.
Why Trump v. Slaughter changes the picture
On 29 June 2026 the US Supreme Court held, by six votes to three, that the for-cause protection for FTC commissioners is unconstitutional. The FTC is the authority that enforces companies' DPF commitments, and the Commission's decision relied on that protection. The EDPB wrote to the Commission on 31 July 2026 asking it to assess closely whether the development affects the functioning of the DPF.
Views differ on its reach. Some note that the DPRC rests on Executive Order 14086 and a Department of Justice regulation, which the Court did not address. Others, including Max Schrems, argue that independent oversight has been weakened. Datatilsynet's advice on 1 July 2026 is a sensible baseline for any EU controller: revisit the country assessment in your TIAs, including those for SCC transfers, and review your exit strategies.
What to do now
- Check on dataprivacyframework.gov that each US recipient is actively certified and that the certification covers the data you transfer. HR data requires specific HR coverage.
- Confirm that the provider's DPA contains SCCs as a fallback if the DPF falls.
- Update TIAs for SCC-based transfers with Trump v. Slaughter and the EDPB letter as new circumstances.
- Write a realistic exit plan for your most critical services. What moves, to whom and how fast?
What regulators expect: a practical cloud playbook
The Danish supervisory authority published a dedicated cloud method in March 2022, also in English. It predates the DPF and is due to be updated, but its three steps remain a solid basis for GDPR cloud computing across the EU.
- Know your services. Which personal data is processed, for what purposes and how? Expect two assessments: one of security of processing and one of data protection by design and by default under Article 25.
- Know your providers. The guidance includes screening questions for providers. They cover add-on services and support, and require an overview of all sub-processors.
- Supervise your providers. Oversight mirrors what you do with any processor. An annual assurance report is often enough, provided it covers the processing you use the service for.
The authority's cloud inspection questionnaire, published in May 2025, asks for the provider, contract date, supported processing activities, data categories and the full processor chain. A current record of processing activities answers most of it.
Security and encryption in the cloud
Article 32 requires appropriate technical and organisational measures, taking the risk into account. Pseudonymisation and encryption are listed as examples, not as absolute requirements. In cloud computing, encryption still often makes the difference, because it can be the supplementary measure that makes a transfer lawful. That only works if the provider cannot access the keys. Data the service must read in clear text to function is not protected from the provider by encryption at rest.
Three questions are worth asking of any cloud service:
- Who controls the encryption keys, and can you hold them outside the provider's reach?
- How is administrator access controlled, and are support sessions logged so you can see who accessed what?
- Are default settings privacy-friendly, as Article 25 requires, or do you have to switch off sharing, telemetry and AI features yourself?
The processor must notify you without undue delay under Article 33(2). You must notify the supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals. Data subjects only need to be told if the breach is likely to result in a high risk, and then without undue delay under Article 34. Agree concrete notice times with the provider, or their internal process will eat your 72 hours. More in our article on security breaches.
Exit and switching providers: the Data Act
The EU Data Act, Regulation (EU) 2023/2854, has given customers a right to switch cloud provider since 12 September 2025. Contracts must specify which data and digital assets can be ported. The notice period may not exceed two months, and the transition period is 30 days as a default. Until 12 January 2027 providers may only charge the direct costs of switching. After that, switching charges are generally prohibited.
The Data Act and GDPR work together here. Article 28(3)(g) GDPR ensures personal data is deleted or returned at the end of the contract. The Data Act makes sure you can actually take it with you. The right to data portability in Article 20 GDPR is a different thing. It belongs to data subjects, not to your organisation.
How to assess a cloud service: eight steps
These steps are the core of GDPR cloud compliance, based on the Danish cloud method and EDPB Opinion 22/2024. Use them for new and existing services.
| Step | What you do | Evidence |
|---|---|---|
| 1. Map the processing | Which data, which data subjects, which purpose and which lawful basis | Record under Art. 30 |
| 2. Set the roles | Is the provider a processor, and does it use data for its own purposes? | Role assessment |
| 3. Review the DPA | Check the Art. 28(3) minimum content and terms on government access requests | Signed or accepted DPA |
| 4. Get the full chain | Name, address, contact, location and task of every sub-processor | Sub-processor list |
| 5. Identify transfers | Where is data processed, and where can it be accessed from, including support? | Transfer register |
| 6. Choose and document the tool | Adequacy, DPF certification or SCCs with a TIA and supplementary measures | DPF check or TIA |
| 7. Assess the risk | Security under Art. 32, by design and by default under Art. 25, and a DPIA under Art. 35 where the risk is high | Risk assessment, DPIA if needed |
| 8. Plan oversight and exit | Annual review of assurance reports and sub-processor lists, plus an exit plan | Oversight note, exit plan |
Step 7 is the one most often skipped, even though a move to the cloud usually calls for a fresh risk assessment. Our guide to the data protection impact assessment helps where the risk is high, and information security risk management shows how one method can serve GDPR and NIS2 at once.
A worked example: reviewing eight cloud services
Brightwater Logistics B.V. and Anna de Vries are fictional. We created them for this article, and they are not customers or a case study.
Brightwater Logistics is a Dutch freight company with 260 employees and eight cloud services processing personal data, from office suite and HR to route planning and backup. Anna de Vries is the data protection officer (DPO) and has to review them all in autumn 2026 after Trump v. Slaughter.
Together the providers' DPAs list 34 sub-processors. Anna sorts them by where data is processed or can be accessed from:
| Location | Count | Transfer tool | Estimated effort |
|---|---|---|---|
| EU/EEA | 21 | No transfer | 0.25 hours each to record = 5.25 hours |
| UK | 3 | Adequacy (Art. 45) | 0.5 hours each = 1.5 hours |
| US, DPF-certified | 6 | DPF (Art. 45), SCCs as fallback | 1 hour each for lookup and fallback check = 6 hours |
| US, not certified | 2 | SCCs and TIA (Art. 46) | 6 hours each = 12 hours |
| India and the Philippines (support) | 2 | SCCs and TIA (Art. 46) | 6 hours each = 12 hours |
| Total | 34 | 13 transfers | 36.75 hours |
The hours are Anna's planning estimates, not benchmarks. The point is that four of the 34 sub-processors take 24 of the roughly 37 hours, because they need a TIA.
Three findings change her priorities. First, the HR system uses a non-certified US support provider that can see sickness absence data in clear text. That is special category data under Article 9, and clear-text transfers to recipients subject to FISA 702 are very hard to justify. Anna asks the provider to restrict support to EU staff and holds approval until it replies. Second, one of the six DPF recipients has no SCC fallback in its DPA. It goes on the list of services that need an exit plan. Third, the office suite's AI assistant is switched on by default and sends prompts to a new sub-processor Brightwater was never notified about. Anna switches it off until the notice arrives and has been assessed.
What GDPR does not require in the cloud
Some claims about GDPR compliant cloud storage make the work bigger than it needs to be.
- Data does not have to stay in the EU. Chapter V regulates transfers, it does not ban them.
- Encryption is not an absolute requirement. Article 32 requires appropriate measures. Encryption is often the right choice, but it depends on the risk.
- There is no "GDPR certified cloud". Article 42 allows certification of specific processing operations under approved schemes, but no provider can make you compliant. Accountability stays with you.
- An assurance report is not enough on its own. ISO 27001, ISAE 3000 and SOC 2 evidence security. They do not answer roles, transfer tools or the sub-processor chain.
The honest limitation of this article is that the DPF's future is unresolved. Nobody can say in September 2026 when the Court of Justice will rule on the appeal, or what the Commission will do after the EDPB letter. What you can do is document your basis today and keep a fallback ready.
Penalties: what is at stake?
Breaches of the Chapter V transfer rules carry fines of up to EUR 20 million or 4% of global annual turnover under Article 83(5). Breaches of Article 28 on processors fall under Article 83(4), with up to EUR 10 million or 2%. Two transfer fines show the scale. The Irish Data Protection Commission fined Meta EUR 1.2 billion on 22 May 2023 for US transfers on SCCs. The Dutch authority fined Uber EUR 290 million in August 2024 for transferring European drivers' data to the US for over two years without a transfer tool.
How .legal supports GDPR cloud computing
The heavy part of GDPR cloud computing is not the law. It is keeping the overview of services, sub-processors and transfers current.
In .legal you register cloud services as IT systems in Data Mapping and link them to the processing activities, processors and sub-processors they belong to. The transfer tool, such as DPF, SCCs or adequacy, is documented on each transfer, so you can find every processing activity that relies on the DPF if the framework falls. The data processor audit service helps you plan and document annual oversight, and Vendor Management keeps supplier assessments in one place. Recurring work such as reviewing sub-processor lists and TIAs can be scheduled in compliance task management.
The platform does not make the legal judgements for you, but it makes them easier to find, reuse and update. Book a demo to see what a supplier chain looks like in practice.
.legal compliance platform
Simplify GDPR compliance for your cloud services
-
Map data flows across all cloud services
-
Manage data processing agreements in one place
-
Track cross-border transfers and safeguards
-
Automated compliance documentation
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
