Gold Membership

Cloud Computing: Not Always a Silver Lining

Cloud computing is one way of fulfilling your IT requirements online.

Applications and documents can all be stored remotely and accessed over the internet through a web browser. At first glance, the concept of cloud computing may provide an ideal and cost-effective way to manage your business's IT needs. Benefits include reduced IT costs, scalability, flexibility of working methods, readily available support and access to new technologies.

There are, however, a number of legal risks associated with cloud computing which you should know about and take steps to mitigate. Many cloud computing service providers offer a contract containing standard terms and conditions.

Your business should not agree to a contract before considering the points addressed below.

Data security and regulation

Who will store your data and where will it be stored?

Often data is stored remotely and sometimes this is outside the borders of the European Economic Area. You will need to ensure that you comply with all your obligations under the Data Protection Act 1998. This requires that personal data must not be transferred outside the European Economic Area unless that country or territory ensures an adequate level of protection for those whose personal data is being processed, such as your customers and employees.

You will be legally responsible for ensuring that all such personal data is adequately protected, so it is essential that you undertake due diligence in this area before allowing data to be transferred to a cloud service provider. You should also consider who, at the cloud service provider, will have access to your data and how this will be controlled and secured. In addition, make sure that you know what law will govern your contract with the service provider. It can be very costly and frustrating to take legal proceedings in a foreign jurisdiction.

Supplier stability and service level agreements

You should undertake careful technical due diligence to understand how stable the cloud computing provider's service will be, for example:

• who will bear the risk in the event that the internet crashes?
• how vulnerable are the systems to damage or downtime owing to earthquakes, fires, floods or computer viruses or hacking?

Many providers expect to suspend their services at any time in the event of unanticipated downtime or unavailability, without liability to their customers. Cloud service agreements often limit the cloud service providers to "as is" services with no warranty. Be sure to read the indemnities and exclusions in the cloud service agreement very carefully and consider how your business may be affected. Talk to us to ensure that a service level agreement is in place that addresses all your concerns, including monitoring and dispute resolution procedures.

It is advisable to make sure that any business insurance you have will continue to protect you as anticipated if you sign up to cloud computing services.

Also, check the service level agreement you have with your internet service provider since any problems with their service provision will affect your business's ability to access the "cloud".

Intellectual property rights and trade secrets

You will need to ensure that your business's intellectual property rights and trade secrets are protected. Consider what your rights of redress will be if these are infringed in the country where the data is held? How practicable will it be to pursue infringements in that country?

Make sure that the contract with the service provider has appropriate non-disclosure provisions and ask us to review these.

Will any third parties have access to your data under the law of the country where the data is held? For example, legal authorities such as revenue and other government departments may have statutory rights to search and seize data under subpoena in the country in which the data is stored.

Ending the contractual arrangement

As with all contracts, think about how the contractual relationship may come to an end, including:

• will your business be able to recover all its data?
• how long will this take?
• will it be returned in the same format in which it was provided?
• will the service provider have any obligations to assist with transferring the data to a new service provider?
• What will happen to your data if the service provider goes out of business?

Cloud computing can offer many businesses a measurable reduction in IT costs, but the service often comes with material risks to your business. Careful planning and good legal advice at the outset can help reduce these risks to your business.

If you need businesses legal advice call our team on 08000 111 303 or fill in the Call Back Request form to the right of this screen.

The contents of this article are for the purposes of general awareness only. They do not purport to constitute legal or professional advice. The law may have changed since this article was published. Readers should not act on the basis of the information included and should take appropriate professional advice upon their own particular circumstances.

News & Events