If you store personal data in the cloud, the GDPR makes you responsible for what your provider does with it. Here is how to check in ten minutes whether your cloud storage meets the requirements.
The General Data Protection Regulation (GDPR) has applied since 25 May 2018 to everyone who processes personal data of people in the EU. If you put customer data, personnel files or email in the cloud, your cloud provider is your processor and you are the controller.
That has three consequences: you sign a data processing agreement, you watch for transfers of data outside the EU, and you make sure security is appropriate. The GDPR does not say that storage in the EU is mandatory, but outside the EU extra conditions apply.
| Situation | What does it mean for the GDPR? |
|---|---|
| Servers and provider in the EU | No transfer outside the EU. The GDPR is the starting point and supervision lies with European authorities, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). |
| Servers in the EU, but a US provider | The data is stored in the EU, but the provider can still be required to hand over data under US legislation such as the CLOUD Act. Assess this risk yourself. |
| Servers outside the EU | Transfer to a third country is only allowed on a valid basis, such as an adequacy decision or standard contractual clauses, and often an extra risk assessment. |
This is general information and not legal advice. Ask your legal adviser or data protection officer to assess your situation.
Go through these questions before you put personal data in the cloud. A good provider answers them without hesitation.
At vBoxx your data is stored in ISO 27001-certified datacenters in the Netherlands and Germany, and a data processing agreement is available. More details on data protection and compliance.
Three Tier III+ datacenters in the EU: maincubes AMS01 (Schiphol-Rijk), Greenhouse Datacenters (Naaldwijk) and maincubes FRA01 (Frankfurt).
The datacenters are EU-owned and operated by EU parties. Data, metadata, backups and support tooling stay inside the EU.
vBoxx is ISO 27001 certified. You can download the certificate on the page about data protection.
Available for all our services. See the legal documents.
Files in vBoxxCloud are encrypted in transit and at rest.
A question about the GDPR and your cloud? We are happy to help.
The GDPR does not make storage in the EU mandatory, but outside the EU extra conditions apply to transfers. Storage with a provider that is itself established in the EU and only falls under European law makes your assessment the simplest.
An agreement between you and your cloud provider about how the provider processes your personal data: only on your instruction, securely, with agreements on sub-processors and data breaches. The GDPR requires one as soon as a provider processes personal data for you.
It can be, for example with a datacenter in the EU and suitable safeguards. But a US provider also falls under US legislation, such as the CLOUD Act. Weigh that risk, especially for sensitive data.
ISO 27001 shows that a provider has information security structurally in order and that an independent party has checked it. It is not a GDPR certificate, but it is solid evidence of appropriate security. Read more in our guide to ISO 27001 and data residency.
On the European cloud storage page we compare vBoxxCloud, ownCloud and Nextcloud, all hosted in the EU.
Cloud storage where you know where it is.
Talk to us about GDPR compliant cloud storage.