Points to consider with cloud services
Cloud services offer several advantages over traditional on-premise solutions. Ease of use, cost aspects and the flexibility to upscale and downscale these services are key reasons why many organisations implement them. However, both the buyer and the provider need to consider a number of specific risks, including:
- Availability
The customer of a cloud service has little control over its availability. Therefore, contractual agreements need to be made to safeguard availability; this is done in the SaaS agreement.
For example, in most cases it’s advisable to have in place an exit arrangement. This document sets out what happens to the cloud service and the customer’s data when the parties part ways. It this data is essential to the customer, a continuity arrangement needs to be made for the eventuality that the SaaS provider goes bankrupt. And even if you part ways on bad terms, various methods are available for resolving disputes.
- Integrity
Both the provider and the customer of a cloud service can make mistakes that jeopardise the integrity of the stored data. If data is lost, this can have far-reaching consequences. Clear agreements with regard to backups, access to and ownership of the data – What is the customer allowed to do with data stored in the cloud? How can the data be exported? – and the quality of the service can help to safeguard data integrity. These agreements are usually laid down in a service level agreement (SLA).
- Confidentiality
If (business) sensitive information is stored through a cloud service, it is important to control the access to this information. It is therefore essential that the service is properly secured. Furthermore, both the customer and provider of a cloud service need to consider the privacy laws and regulations, including the General Data Protection Regulation (GDPR), as almost every cloud service involves storing or processing personal data.
In addition to the above-mentioned general points, each sector may have specific risks that need to be considered, due to laws and regulations or other reasons. Examples include the use of cloud solutions in healthcare or government. The legal advisors of Legal ICT each have their own specialisation and can support your organisation in different subfields.
