UK Companies Using EU Cloud Services: Data Rules

Yes, UK companies can use EU cloud services without moving their data to the EU, provided they put appropriate safeguards in place. The key is that UK data protection law (UK GDPR) restricts transfers of personal data to countries outside the UK, but the EU is not automatically treated as ‘adequate’ for this purpose. Instead, you can rely on specific transfer mechanisms, such as Standard Contractual Clauses (SCCs), to keep the data’s legal protection intact while the cloud provider processes it in the EU.

Background: UK GDPR and International Data Transfers

The UK General Data Protection Regulation (UK GDPR) governs how personal data of individuals in the UK is processed. It applies to any company that offers goods or services to UK residents, regardless of where the company is based. When a UK company sends personal data to a cloud provider located in the EU, that is considered a ‘restricted transfer’ because the EU is not on the UK’s list of adequacy regulations. The UK has granted adequacy to some countries (like Japan and South Korea), but the EU is not one of them. This means you cannot simply move data to an EU cloud without a valid legal basis for the transfer.

However, the UK Information Commissioner’s Office (ICO) has explicitly stated that transfers to the EU are allowed under the UK GDPR if you use the appropriate safeguards. The most common are the UK’s International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum (IDTA) to the EU’s Standard Contractual Clauses. These are essentially contractual promises between you (the data exporter) and the cloud provider (the data importer) that the data will be protected to UK standards.

How the Transfer Mechanisms Work

To legally use an EU cloud service, you need to put in place a transfer mechanism that the ICO recognises. The main options are:

• UK International Data Transfer Agreement (IDTA): This is the UK’s standalone contract for transfers to any country not covered by an adequacy decision. It is designed to be used with EU cloud providers.
• International Data Transfer Addendum (IDTA) to EU SCCs: If your cloud provider already uses EU SCCs, you can add the UK addendum to cover UK data. This is often easier because many EU providers already have the EU SCCs in place.
• Binding Corporate Rules (BCRs): If your company is part of a multinational group, you could adopt BCRs, but these are more complex and time-consuming to get approved.

You must also carry out a Transfer Risk Assessment (TRA) to check that the laws of the destination country (in this case, the EU member state) do not undermine the protection the contract provides. For most EU countries, the TRA will be straightforward because the EU has strong data protection laws, but you still need to document it.

What Counts as ‘Moving Data’?

A common misconception is that if you only access the cloud service remotely, you are not ‘moving’ data. In legal terms, a transfer occurs when personal data is sent to a processor in another country, even if it is only for storage or processing. So, if you upload a file to an EU-based cloud, that is a transfer. Even if you only use an API to process data, the data is still being ‘made available’ to the provider, which counts as a transfer under UK GDPR.

However, there is an exception for ‘transitory’ transfers, where data passes through a country en route to its final destination. For example, if you send data from the UK to a UK-based server, but the data happens to route through an EU node, that is not a restricted transfer. But if the cloud provider’s primary data centre is in the EU, that is a deliberate transfer.

Practical Steps to Use EU Cloud Services Compliantly

If you decide to use an EU cloud provider, follow these steps to stay compliant:

1. Check the provider’s data residency: Confirm that the cloud service stores data only in EU data centres. Some providers offer ‘data residency’ options that let you choose the region.
2. Review the provider’s DPA: The Data Processing Agreement (DPA) should include the UK IDTA or the UK addendum. Many EU providers already have these ready.
3. Do a Transfer Risk Assessment: Document that the EU country has adequate laws to protect the data. The ICO has a template for this.
4. Keep records: Under the accountability principle, you must be able to show what transfers you make and what safeguards you have in place.
5. Inform data subjects: Your privacy policy should mention that data may be transferred to the EU and on what basis.

Common Problems and Misconceptions

One common problem is that some EU cloud providers are unwilling to sign the UK IDTA because they are not familiar with it. In that case, you can use the UK addendum to the EU SCCs, which many providers already accept. Another issue is that some companies assume that because the EU has ‘adequate’ data protection laws, no safeguards are needed. That is incorrect – the UK has not made an adequacy decision for the EU, so you still need a transfer mechanism.

Another misconception is that you can avoid the rules by using a cloud provider that is based in the EU but has servers in the UK. If the data is processed in the UK, then it is not a restricted transfer at all, because the UK is the data’s origin. However, if the provider routes data to the EU for backup or disaster recovery, that would be a transfer.

How to Choose the Right EU Cloud Provider

When selecting an EU cloud provider for UK data, consider the following:

• Data residency options: Does the provider let you choose the EU region for storage? Can you restrict processing to the EU only?
• Contractual flexibility: Are they willing to sign the UK IDTA or addendum? If not, can you use an alternative mechanism?
• Sub-processors: Check if they use sub-processors outside the EU. If so, you need to ensure those sub-processors also have safeguards.
• Support and documentation: Do they provide clear guidance on UK GDPR compliance? Some providers have dedicated pages for UK customers.

It is also wise to ask for a copy of their DPA before signing up, so you can verify that the transfer mechanisms are in place.

Costs and Practical Implications

Using an EU cloud service is not necessarily more expensive than using a UK one. The main cost is administrative: time spent on the TRA and legal review. If your provider is willing to sign the IDTA, the cost is minimal. However, if you need to negotiate custom contracts, legal fees could add up. Also, consider latency – if your users are in the UK, an EU server might add a few milliseconds, which is negligible for most applications.

Frequently Asked Questions

Is the EU considered ‘adequate’ under UK GDPR?

No, the UK has not granted an adequacy decision to the EU. This means transfers to the EU require a transfer mechanism, like the UK IDTA or the addendum to EU SCCs. However, the EU is considered a ‘safe’ destination in practice because of its strong data protection laws, so the risk assessment is usually straightforward.

Can I use EU SCCs for UK data transfers?

Yes, but you need to add the UK International Data Transfer Addendum to the EU SCCs. The EU SCCs alone do not satisfy UK GDPR requirements. The addendum modifies the EU SCCs to make them work for UK data.

What if the EU cloud provider stores data only in the UK?

If the data is stored and processed only in the UK, then there is no restricted transfer. The UK GDPR applies, but you do not need a transfer mechanism. However, if the provider has any sub-processors in the EU, that would be a transfer.

Do I need to do a Transfer Risk Assessment for every EU country?

You need to do a TRA for the specific country where the data will be processed. If your provider uses data centres in multiple EU countries, you should assess each one. In practice, for EU countries, the assessment is usually positive because EU law provides adequate protection.

What happens if I use an EU cloud without any safeguards?

You would be in breach of UK GDPR, which could lead to fines of up to £17.5 million or 4% of your global turnover, whichever is higher. The ICO can also order you to stop the transfer. So it is essential to put the safeguards in place.

Can I rely on the provider’s own compliance with GDPR?

No, the provider’s compliance with GDPR does not remove your obligation as the data controller. You are responsible for ensuring that the transfer has a valid legal basis. The provider’s DPA is a tool, but you must still have the transfer mechanism in place.

Related

• Junction Temperature Calculator: Estimate Tj from Power
• mEq to Grams Calculator: Formula and Examples
• Points per Mile Calculator: Value and Formula