ICO Clarifies Cloud Personal Data Obligations

The Information Commissioner’s Office has published a new guide to cloud computing which serves as a reminder to organisations that they remain responsible for personal data when they outsource data processing to a cloud computing service provider and outlines factors to be considered prior to engaging a cloud provider to ensure compliance with data protection obligations.  The guide, which highlights the importance of having in place a written contract and seeking assurances from the cloud provider about how they keep data secure, will be of value to staff in colleges and universities considering using cloud services for example outsourcing management of staff or student email or using document storage services hosted in the cloud.  The guidance is available on the ICO website.  JISC Legal has a range of sector specific guidance on Cloud Computing and the Law: http://jiscleg.al/CloudComputing.

Posted on 27/09/2012