Cloud Provider Codes of Conduct and GDPR

With the EU GDPR coming into force in May 2018, requirements for managing personal data and maintaining consumer privacy become significantly more stringent, raising concerns about GDPR compliance when using cloud services. In response, two voluntary Codes of Conduct for Cloud Service Providers (CSPs) were published in early 2017: the CISPE Data Protection Code of Conduct and the EU Cloud Select Industry Group (C‑SIG) Code of Conduct. These codes can help customers compare suppliers by providing a shared baseline of expected practices, but competing codes can also create confusion.

The CISPE code applies only to Infrastructure as a Service (IaaS), while the C‑SIG code is broader, covering multiple cloud service types (including SaaS and PaaS). Both codes require full compliance rather than selective adoption, yet compliance claims to date have relied on self-assessment, which limits credibility. Stronger assurance would require independent audits and monitoring bodies with meaningful enforcement authority. Importantly, neither code overrides cloud contracts or Service Level Agreements (SLAs), which are often written by CSPs on a take-it-or-leave-it basis, and neither code replaces the need for independent certification/attestation against required security standards or regulations.

Both codes stress that security and compliance responsibilities are shared between customer and provider, with CISPE offering more explicit clarity on how responsibilities split—likely because IaaS boundaries are easier to define. In most cases, the customer remains the Data Controller and must ensure GDPR-compliant processing through a legally binding agreement. Key areas covered include transparency, subcontracting, breach notification, audit rights, handling government requests, and mechanisms to demonstrate compliance, balanced against the risk of disclosing sensitive security details.

• GDPR comes into force in May 2018 and introduces more stringent privacy requirements.
• Two Codes of Conduct for cloud providers were published in early 2017.
• CISPE announced on February 14, 2017 that over 30 services complied with its Data Protection Code of Conduct.
• The C‑SIG announced on February 15, 2017 the first official version of its Code of Conduct after four years of work.
• GDPR Article 38 encourages the development of codes of conduct to support proper application of the regulation.
• GDPR Article 39 encourages data protection certification mechanisms, seals, and marks.
• The CISPE Code covers Infrastructure as a Service, while the C‑SIG code is more general across cloud service types.
• Both codes are voluntary, but a provider that adopts one must comply fully rather than cherry-picking clauses.
• Compliance evaluation can be self-certified or performed by an independent third party, and claims to date have been self-certified.
• In most cases, the cloud customer is the Data Controller and must ensure compliant processing through a legally binding contract or agreement.

• “Both Cloud Codes are at an early stage in their evolution.”
• “The Codes do not override the contract.”
• “The Codes do not replace certification.”
• “Customer is still responsible.”
• “Responsibility for compliance is shared.”
• “To be credible, future claims of compliance with a Code must be based on independent audits and governance bodies with real teeth.”
• “Both Codes are voluntary.”
• “Self-certification is weaker than independent evaluation.”
• “When an organization uses a cloud service it puts its trust in the CSP to deliver what is promised.”
• “The customer’s need to know the CSP’s approach to security must be set against the risks involved in the CSP disclosing the details of its security processes.”