Module 1 · 1.2

English

Nederlands English Deutsch Français Español

The GDPR in brief, for cloud users

Module 1: Why a European cloud? · Reading time: 11 minutes

Learning objective: After this lesson, you can name the roles and duties from the GDPR that apply when you use a cloud service, and explain why you remain responsible, even when the data sits with someone else.

Key concepts: GDPR, personal data, processing, controller, processor, sub-processor, principles (Art. 5), accountability, data processing agreement (Art. 28), security (Art. 32), transfers (Chapter V), data protection authority, fines (Art. 83)

Why the GDPR suddenly matters here

The GDPR (General Data Protection Regulation) is a European regulation: Regulation (EU) 2016/679. It has applied directly in all EU countries since 25 May 2018. In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises this; every other EU country has its own data protection authority.

You might think: the GDPR is about big companies with customer databases. But Bakkerij De Korrel falls under it too. The mailbox holds orders with names, addresses and phone numbers. The online folders hold rosters, payslips and a copy of a new employee's ID document. The calendar holds customer names next to delivery appointments. All of that is personal data: any information about an identified or identifiable person (Art. 4(1)). And storing, emailing, sharing and deleting it all counts as processing (Art. 4(2)).

One exception: purely private activities, such as your own family photos, fall outside the GDPR (the "household exemption", Art. 2(2)(c)). As soon as it concerns your work, your business or your association, the GDPR applies.

This is explanation, not legal advice.

Three roles: who is who?

Role	Meaning (Art. 4)	At the bakery
Controller	Determines the purpose and means of processing personal data (point 7)	Bakkerij De Korrel
Processor	Processes the data on behalf of the controller (point 8)	The cloud service where the mail and files are stored
Sub-processor	A party the processor itself engages (Art. 28(2) and (4))	The data centre, an external support team, a backup supplier

The key insight: responsibility doesn't move along with the data. The bakery remains the controller, even if the data sits with a cloud service. If the cloud service makes a promise and something goes wrong, the bakery must still be able to show it made a sensible choice and set out clear agreements. This is called accountability (Art. 5(2) and Art. 24).

Note: a cloud service isn't always only a processor. If the provider also uses your data for its own purposes, such as product development, advertising or training its own systems, it is itself a controller for that part. That's one of the things you check in the terms and the data processing agreement (lesson 9.2).

The principles that matter for the cloud

Article 5 lists the principles that every processing activity must meet. For choosing a cloud service, these matter most:

Purpose limitation: you only use data for the purpose you collected it for. A service that uses your customer data for its own purposes clashes with this.
Data minimisation: don't keep more than necessary. A switch is a good moment to tidy up (lesson 3.2).
Storage limitation: don't keep data longer than necessary. Think of old job applications sitting in a mailbox.
Integrity and confidentiality: appropriate security against loss, theft and unauthorised access. This is set out in detail in Article 32: you take measures that fit the risk, such as encryption, access control, recovery after an incident and regular testing.

Four duties you'll encounter when switching

Choose a processor that offers sufficient guarantees (Art. 28(1)). So you need to check how the provider secures data and where it processes it. You'll do this in module 2.
Sign a data processing agreement (Art. 28(3)). This must cover mandatory topics: what is processed, instructions, confidentiality, security, sub-processors, help with data breaches, and what happens to the data when you stop. We cover this in lesson 9.2.
Keep a record of processing activities (Art. 30). A list of your processing activities: which data, why, shared with whom, how long kept. After a switch, you update the recipients and the storage location (lesson 9.3).
Follow the rules for transfers outside the EEA (Chapter V, Art. 44 to 49). If data goes to a country outside the European Economic Area, this is only allowed if that country has an adequate level of protection (an adequacy decision, Art. 45) or with extra safeguards such as standard contractual clauses (Art. 46). Lesson 1.4 covers this.

What happens if something goes wrong?

In the event of a data breach (for example, a hacked account containing customer data), the controller must report it to the data protection authority within 72 hours, unless it's unlikely to pose a risk (Art. 33). The processor must inform the controller "without undue delay" (Art. 33(2)). That's why a good data processing agreement states how quickly the provider will warn you.

The data protection authority can impose fines. For the most serious breaches, the maximum is 20 million euros or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)). For small organisations, the fine is rarely the biggest risk. The real risk is harm to customers and staff, and the trust you lose.

Why this affects your choice of cloud

The GDPR doesn't ban the use of US cloud services. But you must be able to explain why your choice is responsible: which data, which risks, which agreements. The more sensitive the data (health, children, finances, personnel files), the heavier that assessment weighs. For a bakery it's fairly straightforward; for a physiotherapy practice or a school it weighs much more heavily. A service established in the EEA, processing within the EEA and with no sub-processors outside the EEA makes that assessment a lot simpler, because the transfer rules then don't apply.

In practice: what this looks like with a provider

A provider used for business purposes should have a data processing agreement and a list of sub-processors. At WebOké, the FAQ of the Nextcloud manual states that you sign a data processing agreement if you use Nextcloud for business and store other people's personal data in it. With other providers, you'll usually find something similar under "Data Processing Agreement (DPA)" or in the legal documents at the bottom of the website.

Summary

Even a small organisation processes personal data in mail, calendars and files, and so falls under the GDPR.
You are the controller; the cloud service is the processor; its suppliers are sub-processors.
Responsibility doesn't move along with the data: you must choose a processor with sufficient guarantees and be able to explain that choice.
Key articles: 5 (principles), 28 (processor and data processing agreement), 30 (record), 32 (security), 33 (data breach within 72 hours), 44 to 49 (transfers).
Data that stays within the EEA makes the assessment simpler, because the transfer rules then don't apply.

Quiz

Exercise

Exercise E1.2: Your roles and data. Make a short list of the personal data your organisation has stored in the cloud (mail, calendar, files, chat). For each type, indicate who is the controller, who is the processor, and whether any sensitive data is involved.

Exercise E1.2: Your roles and data

Don't enter real names or personal data, only types of data.

Make a list of at least 4 rows: component (mail, calendar, files, chat, other) · type of personal data · whose data (customers, staff, members, students) · special category data (yes/no) · controller · processor.

For which component would a breach cause the most harm, and to whom?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing