DPIA on the use of STACKIT cloud services

© 2026 Ministerie van Justitie en Veiligheid. Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van SLM Rijk. DPIA on the use of STACKIT cloud services Data protection impact assessment on the processing of personal data by STACKIT cloud services Version 1.3 Date 22 April 2026 Status Public Page 1 of 117 Colophon DPIA by Ministry of Justice and Security Strategic Vendor Management Microsoft , Google Cloud and Amazon Web Services (SLM Rijk) Turfmarkt 147 2511 DP The Hague PO Box 20301 2500 EH The Hague www.rijksoverheid.nl/jenv Contact E SLM @minjenv.nl T Project Name DPIA on STACKIT MariaDB, Server and Object Storage Authors Privacy Company and with https://www.privacycompany.eu/ DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Change log Version Date Summary of input 0.1 26 May 2025 Initial draft part A 0.2 31 July 2025 Initial complete draft, track changes in part A after comments STACKIT 11 July 2025 0.3 31 July 2025 Complete draft clean 0.4 1 August 2025 New draft after input SLM 0.5 1 August 2025 Compare with version 0.1 with track changes 0.6 17 September 2025 Clean version 0.7 24 March 2026 Track changes after input STACKIT 1.0 24 March 2026 Final version 1.1 16 April 2026 Track changes after company confidentiality input STACKIT 1.2 16 April 2026 Clean version for final check by STACKIT 1.3 22 April 2026 Final public version after company confidentiality check by STACKIT DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 3 of 117 DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Glossary Content Data All personal data uploaded by a customer (admin of a Dutch government organisation) to the 3 tested STACKIT cloud services.

Customer Data STACKIT’s contractual definition of the combination of Content Data and Usage Data in its standard agreements, no longer relevant for the Dutch government Diagnostic Data Term used in this report to address all personal metadata recorded as a result of the use of the STACKIT Cloud Services. Includes Service Generated Server Logs (including web server access logs) and STACKIT’s own security and infrastructure logs. This category can also include Telemetry Data (but not relevant in this DPIA). DPA Abbreviation of Data Processing Agreement. To prevent confusion, this report does not abbreviate Data Protection Authority, officially named National Supervisory Authority in the GDPR. DPIA Data Protection Impact Assessment. EDPB European Data Protection Board, the body that unites the national DPAs in the EU, and the EDPS, the supervisory authority on the European Institutions . GDPR General Data Protection Regulation, EU Regulation 2016/679.

SCC EU Standard Contractual Clauses (STACKIT uses the June 2021 version) not relevant in the new agreement with the Dutch government. Usage Data STACKIT’s term for some Diagnostic Data (undefined). Service Generated Server logs Diagnostic (personal) Data generated by STACKIT on its cloud servers as a result of actions by admins. Can include Content Data, for example, names of files. SLM Rijk Microsoft, Google Cloud and Amazon Web Services Rijk, abbreviated to SLM Rijk Strategisch Leveranciers Management (Strategic Vendor Management) Microsoft, Google Cloud and Amazon Web Services for the Central Dutch government, URL: https://slmmicrosoftrijk.nl/ Telemetry Data Diagnostic Data sent from an end user device or browser, different from service generated server logs. VM Virtual Machine, called ‘Compute Engine’ by STACKIT DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 7 of 117 Summary STACKIT, short for STACKIT Cloud Services, is a German company and relatively new entrant on the cloud platform market.

The owner is the Schwarz Group, a family enterprise built on the LIDL and Kaufland supermarket chains. STACKIT’s cloud platform is based on OpenStack, and exclusively offered as public (not private) cloud service to customers. Privacy Company tested three of the most commonly used cloud services by hosting a basic web application (NextCloud) on a STACKIT Compute engine (VM) that relied on the other tested services MariaDB and Object Storage for a backend. The processing through these services took place on servers exclusively located in Germany. This Data Protection Impact Assessment (DPIA) was commissioned by SLM Rijk Microsoft, Google Cloud and Amazon Web Services Rijk (the Strategic Vendor Management office housed at the Dutch Ministry of Justice and Security). Outcome: 18 low data protection risks The outcome of this DPIA is that there are no more high data protection risks, provided the national Dutch government organisations take the recommended measures.

Initially, Privacy Company identified 15 high and 3 low risks. STACKIT took a number of mitigating measures and negotiated a new Data Processing Agreement (DPA) with SLM Rijk. Government institutions still have to take a number of specific mitigating measures until STACKIT has implemented the availability of additional logging (expected June 2027). Together, these measures reduce the risks to 18 low residual risks. The 18 low risks and mitigating measures are shown in more detail in the table at the end of this summary. Scope This DPIA assesses the risks of the use of three services in combination: 1. MariaDB , an open source database server. Used for storing structured data. For this DPIA the database stored various configuration settings, file and usage metadata and user-accounts for the Nextcloud application. 2. Server or Compute Engine , a VM with Linux (ubuntu 24.04) as OS, and software such as PHP and Apache to run the Nextcloud application.

The STACKIT agent was used to allow for running command from the STACKIT admin interface. 3. Object Storage , a storage service with an AWS S3 compatible API. This service was used to store the user-managed files in the Nextcloud application. Additionally, Block Storage was used and two logging services (Observability and Logme). Personal data This DPIA is based on a legal analysis of the available public documentation about the tested STACKIT-services, the reply from STACKIT to the findings in the Technical Appendix and part A of the DPIA, a technical examination of the outgoing network data, multiple meetings and the improved privacy terms. To better understand the data processing in log files by STACKIT, a Privacy Company employee has performed a number of scripted scenarios and has accessed the available audit log files from the Admin Console. In addition, a Data Subject Access Request was filed with STACKIT to obtain access to all other Diagnostic, Support and Website data relating to the behaviour of the test admin.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 This report distinguishes between 5 categories of personal data processed by STACKIT:  Content Data  Account Data, in two types: o admin account data o Contact Data from procurement officers  Diagnostic Data, in three types: o Audit logs o Service Generated Server logs o Security logs  Support Data (both the contents of support tickets and metadata)  Website Data, in two types: o the restricted access websites, i.e. the admin console, and o the publicly available stackit.de and stackit.cloud pages with documentation, knowledge base and legal information. These 5 categories of personal data are now specified in the new Data Processing Agreement with the Dutch government. Purposes, roles and legal grounds In its standard DPA, as processor, STACKIT proposed to process the Content Data and audit logs for seven purposes. Two of these purposes (anonymisation, and optimisation and development) were factually in the interest of STACKIT as controller.

As data controller, STACKIT processed the Account, Diagnostic (minus the audit logs), Support and Website Data for 16 purposes, plus the two misplaced processor purposes. As a result of the negotiations with SLM Rijk STACKIT has agreed to become a processor for all five categories of personal data, for 7 specific purposes. The DPA also includes a limitative list of 6 authorised further processing purposes, when STACKIT necessarily has to process some personal data, generally aggregated, for its own legitimate business purposes, in a role as data controller. These contractual improvements have mitigated many of the previously identified high risks. International data transfers STACKIT stores all data in German data centres, and does not engage sub processors or third parties outside of the EU that may have access to the five categories of personal data for the tested services in scope of this DPIA.

If there is any data transfer, it is either incidental and initiated by the customer, for example, when an admin travels outside of the EU and access the services, or if the Customer explicitly instructs STACKIT to process data outside of the EU. This may be the case with services not in scope of this DPIA. Conclusion As a result of the new enrolment framework, with the new DPA for the central Dutch government organisations as negotiated by SLM Rijk, and the measures already taken by STACKIT, Dutch government organisations can use the tested STACKIT services without any high data protection risks, provided they apply the recommended measures. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 15 of 117 Introduction This report, commissioned by Strategic Vendor Management Microsoft, Google Cloud and Amazon Web Services Rijk office (SLM Rijk 1 ) housed at the Dutch Ministry of Justice and Security, is a data protection impact assessment (DPIA) about the processing of personal data when using STACKIT cloud services.

This DPIA report is written by the Dutch privacy consultancy firm Privacy Company. 2 Data Protection Impact Assessment (DPIA) Under the terms of the General Data Protection Regulation (GDPR), an organisation may be obliged to carry out a data protection impact assessment (DPIA) under certain circumstances. According to Article 35, GDPR, a DPIA is required where the organisation is processing personal data on a large scale when it involves likely high risk to the rights and freedoms of the data subjects. The GDPR does not specify what constitutes a large scale. The DPIA is intended to shed light on, among other things, the specific processing activities, the inherent risk to data subjects, and to propose safeguards to mitigate these risks. The purpose of a DPIA is to ensure that any risks attached to the process in question are mapped and assessed, and that adequate safeguards have been implemented to mitigate those risks.

According to the GDPR a DPIA assesses the risks of data processing for the rights and freedoms of individuals. Data subjects have a fundamental right to protection of their personal data and some other fundamental freedoms that can be affected by the processing of personal data, such as for example freedom of expression. The right to data protection is therefore broader than the right to privacy. Consideration 4 of the GDPR explains: “ This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity ”.

This DPIA follows the structure of the DPIA Model mandatory for all Dutch government organisations. 3 Umbrella DPIA versus individual DPIAs Pursuant to article 35 of the GDPR, a DPIA is mandatory if an intended data processing constitutes a high risk for the data subjects whose personal data are being processed. The Dutch Data Protection Authority (Dutch DPA) has published a list of 17 types of data processing for which a DPIA is always mandatory in the Netherlands. 4 If a processing is not included in this list, an organisation must itself assess whether the data processing is likely to present a high risk. 1 SLM Rijk is the abbreviation of the Dutch words Strategisch Leveranciersmanagement (for the central government) Microsoft, Google Cloud and Amazon Web Services. 2 https://www.privacycompany.eu/ 3 In Dutch only: Rapportagemodel DPIA Rijksdienst, 3.0, 25 July 2023, URL: https://www.kcbr.nl/sites/default/files/2023- 08/Rapportagemodel%20DPIA%20Rijksdienst%20v3.0.docx 4 Dutch DPA, list of processings for which a DPIA is required, in Dutch only, Besluit inzake lijst van verwerkingen van persoonsgegevens waarvoor een gegevensbeschermingseffectbeoordeling (DPIA) verplicht is, URL: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt-2019-64418.pdf.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 The European national supervisory authorities (hereinafter referred to as the Data Protection Authorities or DPAs), united in the European Data Protection Board (EDPB) have also published a list of 9 criteria. 5 As a rule of thumb if a data processing meets two of these criteria a DPIA is required. In GDPR terms SLM Rijk is not the data controller for the processing of personal data via the use of STACKIT Cloud Services. The data controller is the individual government organisation that decides to switch from on-premises IT to cloud services from STACKIT. However, as central negotiator for many cloud services, SLM Rijk commissions the umbrella DPIA to detect common data protection risks and negotiate for a framework contract that complies with the GDPR. The umbrella DPIAs assist the government organisations to select a privacy-compliant deployment.

The government organisations must still conduct their own DPIAs. Only the organisations themselves can assess the specific data protection risks, related to the technical privacy settings, nature and volume of the personal data they process and vulnerability of the data subjects. This umbrella DPIA is meant to help the different government organisations with the DPIA they must conduct when they deploy STACKIT Cloud Services, but this document cannot replace the specific risk assessments the different government organisations must make. Scope of this DPIA This DPIA assesses the data protection risks of the use of three commonly used STACKIT cloud services (Compute Engine (Virtual Machine), Object Storage (S3 Compatible and MariaDB(MySQL) Database), with the corresponding admin console. This DPIA covers:  Description of the STACKIT Cloud, STACKIT Object storage and MariaDB MySQL database services, plus the related services that are inextricably linked to the use of these services: the STACKIT admin console, the creation of a STACKIT account to become admin and a STACKIT Cloud Identity (admin) account;  Role and purposes of STACKIT as provider of the tested services  Transfer of personal data, both via content and log files, to countries outside of the European Economic Area;  Exercise of data subject rights;  Retention and backup periods.

Out of scope The following STACKIT services are out of scope of this DPIA:  STACKIT Marketplace  Database services other than MariaDB  AI Model hosting  RabbitMQ  Logging and telemetry processing services  Archiving services  (Confidential) Kubernetes and Cloud Foundry  Git hosting  Secrets Manager 5 The EDPB has adopted the WP29 Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248rev.01, 13 October 2017, URL: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item id=611236 DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 17 of 117  KMS  DNS  Load Balancer  Docs Chatbot The following topics are outside of the scope of this DPIA:  Functional data (organisations need to send data, including personal data, to STACKIT to communicate with the VM and database in the cloud.  The legal grounds for the processing of (special categories of) personal data by the individual government organisations.  Use of other STACKIT Software-as-a-service (SaaS) and Platform-as-a- service (PaaS) in the cloud.  Use of any generative AI services as add-ons to the tested services, or as separate services.  Use of advanced technical support.  Use of Training Services.  Use of additional security logging and monitoring services.  Single Sign-On.

Methodology This DPIA is based on different sources of information and fact-finding strategies. Privacy Company has carefully studied all available public documentation from STACKIT about the tested STACKIT Cloud Services, including information about the different log files. To better understand the data processing in log files by STACKIT, a Privacy Company employee has performed test scenarios including intercepting outgoing data traffic to capture telemetry events, and has accessed the relevant available log files from the different admin consoles. In addition, a Data Subject Access Request (DSAR) was filed with STACKIT to obtain the Diagnostic data relating to the behaviour of the test admin. The technical findings are documented in detail in a separate Technical Appendix. Chronology This DPIA was conducted between April 2025 and April 2026. After testing, the test admin from Privacy Company filed a DSAR for all personal data relating to his activities recorded by STACKIT via the Data Access Request Form.

STACKIT confirmed receipt the same day. The outcomes of the DSAR are discussed in Section 3.6 of this DPIA. The DPA was updated in March and April 2026 based on the negotiated DPA and the new cookie testing. 6 Privacy Company did not submit a new DSAR. On 22 April 2026 STACKIT provided the outcomes of a company confidentiality test. The 3 requests were justified and honoured, by replacing text with [ Confidential ]. 6 Privacy Company performed the new cookie tests on 26 February 2026. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Outline of this DPIA Following the structure of the Dutch central government model DPIA, this DPIA report uses a structure of four main divisions, which are reflected here as “parts”. A. Description of the factual data processing B. Assessment of the lawfulness of the data processing C. Assessment of the risks for data subjects D. Description of mitigation measures Part A explains the data processing by STACKIT and by government organisations resulting from the use of STACKIT cloud services (Compute Engine (Virtual Machine), Object Storage (S3 Compatible and MariaDB(MySQL) Database), and admin console.

Part A starts with a description of the main categories of personal data processed by STACKIT, and an analysis of the standard contractual terms, compared with possible improvements that can be copied from the negotiated enrolment framework for STACKIT Cloud Services for the Dutch government. Section 2 describes the tested services, and the contents of the different log files generated by STACKIT. This starts with a description of the way the data are collected and processed and describes the categories of personal data and data subjects that may be affected by the processing, the purposes of the data processing, the different roles of the parties, the different interests related to this processing, the locations where the data are stored, compliance with ePrivacy rules, and the retention periods. In this Section, factual contributions and intentions from STACKIT are included. Part B provides an assessment by Privacy Company, with input from STACKIT, of the lawfulness of the tested STACKIT data processing.

This part assesses conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, and the legal ground(s) for the processing, as well as the necessity and proportionality of the processing. This section ends with an analysis how the rights of the data subjects are respected. Part C assesses the risks to the rights and freedoms of the data subjects created by the processing activities identified in Part A of this DPIA. It identifies specific risks that may result from the tested data processing by determining (1) the likelihood that such a risk may occur, and (2) the severity of the impact on the rights and freedoms of the data subjects if the risk occurs. Finally, Part D contains concrete measures that can be taken by either STACKIT or the individual government organisations to mitigate the risks identified in Part C. These measures might either reduce the chance the risks occur, or the impact they might have, or both.

Part D also contains an assessment of any residual risk(s) that cannot or will not be mitigated by applying the suggested measures. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 19 of 117 Part A. Description of the Data Processing This first part of the DPIA provides a description of the characteristics of the personal data that can be generated and processed if a government organisation uses a VM with a database in STACKIT's public cloud. Specifically, Privacy Company tested the use of a Computer Engine Virtual Machine (VM) and a MariaDB database instance, with a focus on the common use case of web-applications hosted on a cloud-hosting service This DPIA also addresses the personal data collected about admin behaviour in the cloud services, including data collected through use of the admin console. Part A continues with a description of the different categories of personal data that may be processed, the categories of data subjects that may be affected by the processing, the purposes of the data processing by STACKIT, the locations where data may be stored, processed and analysed, and the roles of the government organisations, and of STACKIT, as processor or as (joint) data controllers.

Finally, this Section provides an overview of the different interests related to the processing, and of the retention periods. 1. Description of the tested STACKIT Cloud Services This Section describes STACKIT, and the different STACKIT services tested for this DPIA. 1.1 About STACKIT STACKIT is a German company, full name STACKIT GmbH & Co. KG, housed in Neckarsulm. The brand name STACKIT is short for STACKIT Cloud Services. 7 The owner is the Schwarz Group, a family enterprise built on the LIDL and Kaufland supermarket chains. The Schwarz Group was founded in 1930. Currently, the Schwarz group has 575.000 employees, and 13.900 stores (in 2021) in Europe and the USA. 8 Similar to the cloud services offered by AWS as a result of a need for large scale data processing for the webstore Amazon, the STACKIT cloud service was originally developed to serve the company internal business needs, but later offered to external customers.

STACKIT’s cloud platform is based on OpenStack, and exclusively offered as public (not private) cloud service to customers. 1.2 Tested Services The primary services tested are: 1. MariaDB an open source MySQL database instance, used to store structured data like configuration settings and user accounts, 2. STACKIT Server , a virtualization platform (VM Compute Engine ) with webserver software plus NextCloud as a representative web-application hosting application, along with STACKIT agent to facilitate commands from the STACKIT admin interface, and 3. STACKIT Object Storage , to contain user-managed files in the Nextcloud application. 7 STACKIT, Service Description STACKIT Cloud, 1.1 Introduction, version 1.3, valid from 28 October 2024, URL: https://www.stackit.de/en/general-terms-and-conditions/service- description/. 8 Wikipedia, Schwarz Group, URL: https://en.wikipedia.org/wiki/Schwarz Group, page last visited 24 May 2025.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 21 of 117 STACKIT portal automates back-ups, replication, patches, encryption and on demand storage capacity increases. 10 The system administrator configures the access and authorisation policy and controls monitoring/logging. In the test scenario a user account was created in NextCloud and stored in the MariaDB database, including the authentication data. Privacy Company also created an object storage bucket for additional testing. 1.2.2 STACKIT Server Privacy Company created a Virtual Machine (VM) in STACKIT's public cloud, called ‘Compute Engine’. Privacy Company deployed a basic web application (NextCloud) on the VM, that relied on the other tested services for a backend. A VM is an emulation or virtual representation of a computer system that provides the functionality of a physical computer (also known as bare metal server ).

One physical cloud server can host many virtual machines, with different operating systems and applications. The different VMs are sandboxed , isolated from each other, and prevented from interfering with the physical computer. STACKIT's Compute Engine is an Infrastructure as a Service (IaaS) offering, which provides scalable computing capacity using server instances in STACKIT's global data centres. The location of the VM was set to be in Germany, as STACKIT only offered DE as geolocation during set-up. See Section 8 about the geolocation choices available for customers. Since VMs are usually used to host web servers, Privacy Company installed open source software (e.g. Debian, Apache and ModPHP) as webserver software on the VM, and NextCloud, which is a self-hosted secure file hosting package like Dropbox, on top of the web server as an example application. Figure 2: the VM as it appears in the STACKIT admin dashboard 1.2.3 STACKIT Object Service STACKIT offers multiple types of hosted data storage.

Privacy Company focused on testing Object Storage. Object Storage is an unstructured collection of files that can be created, used, and deleted quickly. 10 Your benefits in the cloud, STACKIT, undated, URL: https://www.stackit.de/en/cloud/benefits/ (page last visited 8 May 2025). DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 In contrast, Block Storage (which includes automatic backups) is designed for persistent data storage. Privacy Company tested Block Storage incidentally while performing other tasks. 2. Legal: personal data and enrolment framework The Dutch government DPIA model requires that this Section provides a list of the categories of personal data that will be processed, and per category of data subjects, what personal data will be processed by the product or service for which the DPIA is conducted. However, since this is an umbrella DPIA, only general descriptions can be provided of the categories of personal data and data subjects, in Sections 2.4 and 2.5 respectively.

Section 3 describes the specific personal data that STACKIT processes based on the technical findings of the test set-up. This Section starts with an explanation of the legal definitions, followed by an explanation of the different categories of personal data processed by STACKIT when a government organisation decides to use the tested services. Section 2.3 describes the future enrolment framework. The Dutch government has signed a master agreement with STACKIT, with a specific Data Processing Agreement based on the Dutch government model Arbit 2020. In general, when analysing the data processing by a cloud provider, three main categories of data flows can be distinguished: 1. Content Data stored on the cloud provider’s servers, often called ‘Content’, ‘Customer Content’ or ‘Customer Data’. In this case: Content Data stored by the government organisation on the VM and in the databases. 2.

Diagnostic Data . All data generated or collected by the cloud provider about the use of the public cloud services, including visits to its public website to look-up for example relevant help documentation and privacy policies, and the (restricted access) websites requiring log-in by an administrator. The term Diagnostic Data used in this DPIA as an overarching term for all metadata, and also includes the subcategory ‘Telemetry Data’. 3. Functional Data , data that are temporarily processed by the cloud provider to execute desired functionalities. The key difference between Functional Data and Diagnostic Data as defined in this report, is that functional data are and should be transient. 11 This means that these data should be immediately deleted or anonymised upon completion of the transmission of the communication. Otherwise they qualify as Content Data or Diagnostic Data. As long as the cloud provider does not store these Functional Data, they are not Diagnostic Data. 11 Compare Article 6(1) of the EU ePrivacy Directive (2002/58/EC, as revised in 2009 by the Citizens Rights Directive) and explanation in recital 22: “ The prohibition of storage of communications and the related traffic data by persons other than the end users or without their consent is not intended to prohibit any automatic, intermediate and transient storage of this information in so far as this takes place for the sole purpose of carrying out the transmission in the electronic communications network and provided that the information is not stored for any period longer than is necessary for the transmission and for traffic management purposes , and that during the period of storage the confidentiality remains guaranteed. ” DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 23 of 117 Figure 3: Content Data, Functional Data and Diagnostic Data Content Data Functional Data Diagnostic Data This DPIA is focussed on the data protection risks of the processing of Diagnostic Data, but also addresses the data protection risks resulting from the processing of personal data in Content, Account, Support and (restricted access) Website Data by a public cloud provider. 2.1 Definition of personal data According to article 4(1) (a) GDPR, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

The concept of processing is defined in Article 4(2) of the GDPR: “ ’processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. ” The GDPR explains that pseudonymised data are personal data, to which the GDPR applies. Recital 26 explains: DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 “ Pseudonymised personal data that can be linked to a natural person through the use of additional data should be regarded as data relating to an identifiable natural person. In order to determine whether a natural person is identifiable, account must be taken of all means that can reasonably be expected to be used by the controller or by another person to directly or indirectly identify the natural person, for example selection techniques.

In determining whether any means can reasonably be expected to be used to identify the natural person, account shall be taken of all objective factors, such as the cost and time of identification, taking into account available technology at the time of processing and technological developments. ” In its recent guidance on pseudonymisation the EDPB explains that “ the desired effect of pseudonymisation is to control the attribution of personal data to specific data subjects by denying this ability to some persons or parties. ” 12 The EDPB emphasises that pseudonymous data are still personal data, and processing needs to comply with the GDPR. The EDPB takes an absolute stance with regard to identifiability when it states: [Pseudonymous data are personal data, addition Privacy Company] “ This statement also holds true if pseudonymised data and additional information are not in the hands of the same person.

If pseudonymised data and additional information could be combined having regard to the means reasonably likely to be used by the controller or by another person, then the pseudonymised data is personal. Even if all additional information retained by the pseudonymising controller has been erased, the pseudonymised data becomes anonymous only if the conditions for anonymity are met. ” 13 2.2 Five categories of personal data In order to provide a precise analysis of the different types of personal data processing and their impact, this DPIA distinguishes between five categories of personal data that STACKIT can process as a result of the use of the tested set-up.  Content Data (referred to as Customer Data by STACKIT in the publicly available DPA used for this DPIA 14 )  Account Data, in two types: o admin account data o Contact Data from procurement officers  Diagnostic Data  Support Data (both the contents of support tickets and metadata)  Website Data, in two types: o the restricted access websites, i.e. the admin console, and o the publicly available stackit.de and stackit.cloud pages with documentation, knowledge base and legal information. 12 EDPB, Guidelines 01/2025 on Pseudonymisation, 17 January 2025, consultation version, par. 4, URL: https://www.edpb.europa.eu/system/files/2025- 01/edpb guidelines 202501 pseudonymisation en.pdf 13 Idem, par. 22. 14 STACKIT Data Processing Agreement, version 2.2, undated, URL: https://www.stackit.de/wp-content/uploads/2025/05/STACKIT AV-Vertrag STACKIT-Cloud- Services-2.2 englisch 202505.pdf?x26150 DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 25 of 117 Figure 4: Five different categories of personal data In its Data Protection Notice, STACKIT mentions processing of Customers personal data, Account, Support and Website Data. 15 In STACKIT’s publicly available standard DPA (version as tested for this DPIA), STACKIT only mentioned two categories of personal data: Customer Data and Usage Data.

STACKIT defined Customer Data as: “ all types of personal data contained in documents and other electronic formats processed using the STACKIT Cloud Services; in particular all personal data of any kind which the Customer stores in the STACKIT Cloud. The type of data is not limited according to the agreed terms; therefore, the processing may include the following types of personal data: salutation, name, business address, e-mail address, telephone number, depending on the STACKIT Cloud Services used .” 16 STACKIT defined Usage Data as a sub category of Customer Data: 15 STACKIT Data Protection Notice, undated, version 4.2, URL: https://www.stackit.de/en/data-protection-notice/ (page last visited 24 July 2025). At the start of this DPIA, STACKIT published version 4.0, also undated at the same URL. 16 STACKIT Data Processing Agreement, no version number and undated. Privacy Company used version 2.2 from May 2025, URL: https://www.stackit.de/wp- content/uploads/2025/05/STACKIT AV-Vertrag STACKIT-Cloud-Services- 2.2 englisch 202505.pdf.

STACKIT has since updated to version 2.3, URL: https://www.stackit.de/wp-content/uploads/2025/06/STACKIT AV-Vertrag STACKIT-Cloud- Services-2.3 englisch 202506.pdf Based on the URL, it is reasonable to assume the 2.3 version was authored or published in June, 2025. These URLs are no longer available, STACKIT only publishes legal documentation on stackit.com. The current public DPA, undated version 2.4.1, is available at https://stackit.com/en/asset/download/34534/file/STACKIT data processing agreement.pdf?v ersion=10. In reply to this DPIA, STACKIT explained the term Customer Data was meant to be broader than only the personal data uploaded by the Customer. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 “ the usage of the STACKIT services by the Customer (hereinafter referred to as "Usage Data", which also constitute Customer Data within the meaning of this Agreement). ” 17 This DPIA does not follow STACKIT’s use of the term Customer Data (including Usage Data), nor the four categories of data mentioned in the Data Protection Notice, because STACKIT’s descriptions do not cover all personal data, and there are differences in both the impact and the probability of unauthorised access to the different kinds of personal data.

The distinction in five categories of personal data also make this DPIA more comparable with other public DPIAs for the Dutch government on public cloud services. 2.2.1 Content Data Content data are the personal data uploaded by customers to a storage bucket, database or VM in the STACKIT Cloud. Content Data do not include the Account Data, and may also include non-personal data. STACKIT may collect Content Data in for example screenshots if an admin reports a bug or asks a support question through the Jira Service Management. This specific processing is analysed in Section 3.1 below. To test STACKIT’s processing of possibly sensitive Content Data, Privacy Company created (1) a note with fictive medical information, (2) a photo of a user, (3) a csv file with a random combination of (fictional) complaints from 871873 (fictional) citizens related to the public space, with names and BSN (Burgerservicenummer is a government identifier), (4) a Word document containing (fictional) personal health data of an employee, and (5) a publicly available PDF file.

See the Technical Appendix for details. This DPIA cannot provide a description of all possible kinds of Content Data that government organisations may process with the tested services, as this depends entirely on the nature and data processing purposes of the organisations. To help government organisations perform their own DPIA, Section 2.4 below contains a description of categories of personal data whose processing has a different impact on data subjects, and are therefore relevant for the risk assessment. Section 2.5 below similarly provides a high-over description of the different kind of natural persons involved by the data processing, the data subjects. 2.2.2 Account Data Account data primarily are account information about admins. STACKIT mentions these data in its Terms of Use as: “administrative contact person to the platform, who has all the decision-making powers and authorities required in connection with the performance of the services.” 18 STACKIT also processes a second category of Account Data: the contact data of resellers or procurement officers that procure the licenses for an organisation (Commercial Contact Data).

It is possible (as in the test set-up by Privacy Company) that an admin and contract owner are identical, but with larger government organisations, the roles are likely assigned to different employees or external resellers. STACKIT describes the data processing of these data in section E of the 17 Idem. 18 STACKIT Terms of use, Section 10: Customer’s duties of cooperation, Version 1.2, 28 October 2024, URL: https://www.stackit.de/en/general-terms-and-conditions/terms-of-use/. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 27 of 117 STACKIT Privacy Policy, Processing of Customers’ Personal Data. 19 STACKIT explained in reply to this DPIA: “ From our point of view this data/ these purposes are not part of the data processing on behalf and because of this not part of the DPA. ” 2.2.3 Diagnostic Data Diagnostic data are the metadata that STACKIT collects and stores about the behaviour of system administrators and performance of the VM and databases.

The term Diagnostic Data includes service generated server logs with personal data, Telemetry Data and STACKIT's own security logs. STACKIT describes the existence of some Diagnostic Data in the Appendix to its DPA, as: “ personal or personally identifiable log data (user name, IP address, log files). ” 20 The technical details are described in Section 3.2.2 below. 2.2.4 Support Data Support data are generated when a government organisation files a Support Request with an admin STACKIT account through the restricted access STACKIT admin Panel. A Support Request may include an attachment, such as a screenshot of contents of a database. STACKIT also collects metadata about the Support Requests filed by its customers. These data always relate to an identifiable STACKIT customer (admin account). Finally, STACKIT may or may not share support information with the company Atlassian, depending on how STACKIT configured its instance of Jira Service Management.

The actual contents of the Diagnostic and the Website data that may be part of Support Data will be explained in more detail in Sections 3.1 and 3.2 of this report. 2.2.5 Website Data This report identifies two categories of Website Data: 1. Restricted access Website Data 2. Publicly accessible Website Data The relevant restricted access Websites are: 1. accounts.stackit.cloud (login portal) 2. support.stackit.cloud (support portal) 3. console01.api.iaas.eu01-m.stackit.cloud (server management console) 4. portal.stackit.cloud (admin console) The relevant publicly accessible Websites are: 1. docs.stackit.cloud (documentation) 2. www.stackit.de/en/general-terms-and-conditions (legal information) 3. www.stackit.de/en/knowledge (audits) Both categories of Website Data include data collected by cookies, pixels, URL parameters and other similar technologies to read information from the end user browser.

Technically, as described above, Website Data are a form of metadata on the behaviour of system administrators, and therefore part of the broad category of 19 STACKIT Privacy Policy, version 4.2, URL: https://www.stackit.de/en/data-protection-notice/ 20 STACKIT Data Processing Agreement, undated, version 2.2, Annex 1, Type of Data, URL: https://www.stackit.de/wp-content/uploads/2025/05/STACKIT AV-Vertrag STACKIT-Cloud- Services-2.2 englisch 202505.pdf. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Diagnostic Data. However, for analytical clarity, and because of differences in inspection methods, this report separately analyses the data recorded through the use of the STACKIT-websites. STACKIT mentions Cookies in a Cookie Policy, and data processing through cookies in its Data Protection Notice. STACKIT does not mention the Website Data in its Data Processing Agreement. 2.3 Enrolment framework STACKIT publishes an overview of applicable terms and conditions for its public cloud services.

See Figure 6 below. This overview does not mention STACKIT’s Data Protection Notice. 21 However, when Privacy Company signed an order form with STACKIT to test the services, the contract stated that this Data Protection Notice applied to the processing, next to the Terms. Figure 5: STACKIT confirmation to Privacy Company 22 In reply to this observation, STACKIT wrote: “ Apply means regarding the Data Protection Notice that this is the relevant information but not that there is a binding effect like for the Terms and Conditions. ” 23 STACKIT’s comment is not logical. STACKIT publishes a Data Protection Notice to inform customers how it processes personal data, for what purposes etcetera, when STACKIT acts as data controller. The customer has no other source of information for data processing that factually takes place, but is not mentioned in the Data Processing Agreement. This DPIA uses the descriptions of this data processing from the Data Protection Notice and assumes they apply to the different personal data STACKIT obtains as a result of the use of the tested cloud services, absent a new Data Processing Agreement with different conditions with the Dutch government.

STACKIT’s Data Protection Notice describes purposes for the processing of Admin Account, Support and Website Data. During the writing of this DPIA, STACKIT updated its Data Processing Notice, without sending any mail to the (test) admin. STACKIT does not provide a compare with an earlier version, nor an archive of past versions. 21 STACKIT Data Protection Notice, undated, version 4.2, URL: https://www.stackit.de/en/data-protection-notice/ (page last visited 24 July 2025). At the start of this DPIA, STACKIT published version 4.0, also undated at the same URL. 22 Draft order contract provided by STACKIT to Privacy Company 3 March 2025, final order received and signed 28 March 2025. 23 Reply STACKIT to part A of the DPIA, 11 July 2025. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 29 of 117 Figure 6: STACKIT terms and conditions for Cloud services 24 STACKIT’s standard Data Processing Agreement 25 (DPA) -the version tested for this DPIA- specified that STACKIT acts as processor for the Customer Data, and that this includes ‘Usage Data’, defined as “ the usage of the STACKIT services by the Customer ”, with processing purposes.

The DPA does not contain a limitative list of the personal data STACKIT qualifies as ‘usage data’. The description seems to exclude STACKIT’s infrastructure security logs with for example IP addresses of persons that access information in a VM or database. 26 See Section 3.3.4. STACKIT’s standard DPA did not mention Account, Support or Website Data. During the writing of this DPIA, STACKIT updated its standard DPA, without sending any mail to the (test) admin. STACKIT did not provide a compare with an earlier version, nor an archive of past versions. STACKIT acknowledges in its DPA it may be forced to act as data controller: “ The Contractor shall process the Customer Data in accordance with the Customer's instructions, unless the Contractor is under a statutory obligation to process said data in a different manner. In the latter case, the Contractor shall notify the Customer of 24 New screenshot added, since the URL: https://www.stackit.de/en/general-terms-and- conditions/cloud-services/ has been rerouted to https://stackit.com/en/gtc/cloud-services (last visited 15 April 2026). 25 STACKIT Data Processing Agreement for STACKIT cloud services, version 2.3, Data Processing Agreement, undated, but it follows from the document metadata that the document was created 17 June 2025, URL: https://www.stackit.de/wp- content/uploads/2025/06/STACKIT AV-Vertrag STACKIT-Cloud-Services- 2.3 englisch 202506.pdf When Privacy Company wrote part A, version 2.2 was in place, also undated, at URL: URL: https://www.stackit.de/wp-content/uploads/2025/06/STACKIT AV- Vertrag STACKIT-Cloud-Services-2.3 englisch 202506.pdf. 26 STACKIT commented that IP addresses were mentioned in the public DPA, as part of personal or personally identifiable log data.

Reply STACKIT to this DPIA, 9 April 2026. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 these legal requirements prior to commencing processing, unless the relevant law forbids such notification on the grounds of important public interest. ” 27 Besides the Data Protection Notice, the Terms of Use 28 and service specific rules apply. In Article 9.4 of the Terms of Use, STACKIT provides some specific acceptable use rules (instead of a separate Acceptable Use Policy). Figure 7: STACKIT Acceptable use rules 29 It follows from STACKIT’s (general) Terms of Use that there are additional terms in service specific descriptions. 27 Idem, Section 3.1 28 STACKIT Cloud Terms of Use, version 1.2, valid from 28 October 2024, URL: https://www.stackit.de/en/general-terms-and-conditions/terms-of-use/ 29 Article 9.4 STACKIT’s Terms of Use, version 1.2. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 33 of 117 also, authentication details of admins that may provide access to large datasets with such sensitive data.

The sensitivity of the data is related to the level of risk for the data subjects in case the confidentiality of their data is breached. Risks may vary from spear-phishing admins, to capturing IP addresses of website visitors hosted on a VM if their IP addresses should remain utterly confidential, such whistleblowing via a government website such as “meldmisdaadanoniem.nl” (report crime anonymously). 2.4.3 Special categories of personal data and data about convictions Based on the GDPR, the processing of special categories of personal data is prohibited, unless one of the exceptions applies from the limitative list included in the GDPR. According to Article 9 (1) GDPR, personal information falling into special categories of data are any: “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation”.

With special categories of data, the principle is one of prohibition: special data may not be processed. There are exceptions to this rule, however, for instance when the data subject has explicitly consented to the processing, or when data have been made manifestly public by the data subject, or when processing is necessary for the data controller to exercise legal claims. The rules for data relating to criminal convictions and offences are even stricter in the GDPR: only permitted when under the control of official authority or when the processing is authorised by Union or Member State law (Art. 10 GDPR). Based on the Dutch GDPR implementation law, government organisations can invoke the same exceptions as for the processing of special categories of data (Art. 32 and 33 UAVG). It is possible to process any special categories of personal data or criminal data with the tested services on STACKIT cloud. 2.5 Possible categories of data subjects This umbrella DPIA can only indicate categories of data subjects that may be involved in the processing but cannot assess the specific risks of the actual data processing per organisation that uses or will use the STACKIT cloud services.

As described in Section 2.2.1 of this report, each government organisation determines itself what personal Content Data it wants to store in a storage bucket or database on a cloud server, relating to what natural persons. Such buckets and databases may include lists of Customer’s customers, patients, clients, employees, suppliers and/or end-users. Specific types of data subjects are included in the Account and Diagnostic Data: the admins and commercial procurement officers of a government organisation. The government organisation must keep an overview of the different categories of data subjects in its data processing inventory (Article 30 GDPR), and must list these categories of data subjects in the Standard Contractual Clauses, when such clauses apply to the transfer of personal data to a third country. In the SCC from the European DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Commission, the Annex contains a separate list of the category or categories of data subjects. 35 Possible types of data subjects are:  Employees, contractors and temporary workers (current, former, prospective) of data exporter;  Dependents of the above;  Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former);  External persons (e.g., customers, citizens, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services;  Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter;  Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter);  Minors; or  Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.). 3.

Results of the technical investigation In order to better understand the data processing in log files by STACKIT, a Privacy Company employee has performed test scenarios and has subsequently accessed the available log files in the (web) admin console. In addition, a Data Subject Access Request (DSAR) was filed with STACKIT to obtain the Diagnostic data relating to the behaviour of the test admin. The results of the DSAR are discussed in Section 3.6 of this report. This Section explains in detail what Diagnostic Data were observed in the technical inspection of the data, and why some of these stored Diagnostic Data on the use of the tested STACKIT services are personal data as defined in article 4(1) of the General Data Protection Regulation (GDPR). 3.1 Content Data During testing Privacy Company did not observe unexpected types of processing of the Content Data. For example, during the limited testing, Privacy Company did not see an active request from STACKIT for Feedback, nor a passive option.

However, in reply to this DPIA, STACKIT explained it can send a request for Feedback to admins after completion of a support ticket. 36 STACKIT does not provide backups as a standard, only when separately contracted. 37 35 European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, URL: https://eur- lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN. 36 Reply STACKIT to part A of the DPIA, 11 July 2025. 37 STACKIT Service Description STACKIT Cloud, Section 2.6, Version 1.3, 28 October 2024, URL: https://www.stackit.de/en/general-terms-and-conditions/service-description/. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 35 of 117 However, STACKIT does offer services that process Content Data outside the scope of this DPIA, such as AI models.

Prior to using these services, government organisations would have to conduct a separate DPIA. 3.2 Account Data If organisations want to start using STACKIT services they first have to create a STACKIT account on the STACKIT portal page. 38 During the creation of the STACKIT account, STACKIT only collects the e-mail address (on the domain of the employer), and the password, no other identifying data. To login to a federated account (relevant to government organisations,) users will work with their employer's existing authentication methods which may include multi- factor authentication. During account creation, users do not have to provide new data to STACKIT beyond their work e-mail address. 39 3.2.1 Billing Data During account creation for an organisation outside of the DACH region (Germany, Austria, Switzerland) the administrator must first create a STACKIT account as described above, then fill out an online contact form with a request to the STACKIT sales department.

It is not yet possible to directly order the requested services online. STACKIT collects the following data: 40  E-mail address (on the domain of the employer)  First and last name of the contact person  Company name and address Once the organisation's account is created, the admin needs to provide billing information for the organisation. The admin can, but is not required to, add more account information, including: 41  Title  Phone number Payment methods include invoices sent to an e-mail address, or credit cards which also require an e-mail address for invoice receipts. STACKIT sends the credit card payment data to payment processor Adyen. These data are: 42  Cardholder Name  Card number  Expiry date  CVC/CVV 38 STACKIT, Create a User Account, undated, URL: https://docs.stackit.cloud/stackit/en/step- 2-setup-a-user-account-35914426.html (page last visited 15 May 2025). 39 STACKIT, Log in to the STACKIT Portal, undated, URL: https://docs.stackit.cloud/stackit/en/log-in-to-the-stackit-portal-250119066.html (page last visited 15 May 2025). 40 STACKIT, Creation and Management of Customer Account, undated, URL: https://docs.stackit.cloud/stackit/en/creation-and-management-of-customer-account- 350290030.html (page last visited 15 May 2025). 41 STACKIT, Creation and Management of Customer Account, undated, URL: https://docs.stackit.cloud/stackit/en/creation-and-management-of-customer-account- 350290030.html (page last visited 15 May 2025). 42 STACKIT, Payment Methods, undated, URL: https://docs.stackit.cloud/stackit/en/payment- methods-350290052.html (page last visited 15 May 2025).

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 3.2.2 Newsletters During and after testing, Privacy Company only received functional mails from STACKIT, related to account signup, multi-factor authentication and updates for the support ticket. STACKIT initially offered a form for admins and other interested people to sign-up to newsletters, as shown in Figure 10 below, STACKIT asked for consent to accept ‘marketing cookies’ in its newsletter subscription form. Figure 10: STACKIT newsletter subscription form The links to ‘marketing cookies’ and the ‘Cookie Note’ both referred to the same Cookie Policy. This policy does not mention use of tracking pixels and similar technology, such as beacons, to track individual reading behaviour of the newsletters The consent form also did not describe the contents of the newsletter admins could subscribe to: whether these newsletters contain essential information about updates and patches, or only commercial information.

In reply to this DPIA STACKIT explained that subscriptions to its newsletters are entirely voluntary. The newsletters do not provide information that is essential for admins about updates or security patches. 43 STACKIT has apparently removed the option to subscribe to newsletters. See Figure 11. 43 Reply STACKIT to part A of the DPIA, 11 July 2025. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 37 of 117 Figure 11: No more newsletter subscription option 44 3.3 Diagnostic Data STACKIT collects and stores metadata about the behaviour and performance of systems and services, including data about the system’s use by administrators and potentially by end-users. This subcategory of metadata is part of the category of Diagnostic Data in this DPIA. Additionally, STACKIT collects Diagnostic Data about visits to its own public and restricted access websites. These Website Data are described separately in Section 3.4 below. 3.3.1 Audit logs Admins can view logs through a website provided in the admin panel, as shown below in Figure 12.

Figure 12: Screenshot of STACKIT admin portal audit logs 44 Screenshot 23 July 2025, on https://www.stackit.de/de/newsletterverwaltung/. The English page at https://www.stackit.de/en/newsletter-subscription/ shows a 404 – Page not found. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 43 of 117 1. The restricted access admin console, the login page and the support portal, and 2. The publicly accessible STACKIT.de and cloud.stackit.de with relevant technical and legal documentation . The default setting on both types of Websites is privacy friendly and effective. STACKIT only sets functional cookies. Analytics and marketing cookies are disabled by default. 3.5.1 Restricted access Website Data As shown in Figure 14 STACKIT showed a pop-up with a kind of cookie consent text when the new admin first logged in to the admin console. Figure 14: STACKIT pop-up banner about cookies In the banner, STACKIT tells admins that they can select ‘Reject’ to only allow the use of technically necessary cookies.

With ‘Select’, admins can allow cookies for other purposes. The button for ‘Accept’ is emphasised in yellow. In reply to this observation, STACKIT wrote: “ We will emphasize the buttons for rejecting cookies more clearly. ” Privacy Company chose ‘Reject’ and only observed strictly necessary cookies on the Login Portal (accounts.stackit.cloud), the Support Portal (support.stackit.cloud) and the admin console (portal.stackit.cloud). Admins can access a fourth restricted access website, console01.api.iaas.eu01-m.stackit.cloud, for server management, but this website did not set any cookies at all. As shown in the Technical Appendix, in Sections 6.1, 6.3 and 6.5, STACKIT sets many functional cookies for which no documentation is available. The cookie consent banner does not provide more information about the observed cookies, only a description of the purpose. To get more information about the data processing, users have to search for STACKIT’s Cookie Policy to see a list of cookies, with their purpose and lifespan. 58 This policy only contains 3 technically necessary cookies, but Privacy Company 58 STACKIT, Cookie Policy, undated, URL: https://www.stackit.de/en/cookie-note/ (page last visited 8 May 2025).

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 45 of 117 Figure 15: STACKIT Cookie banner on docs.stackit.cloud STACKIT shows three categories of cookies when a user clicks on ‘Cookie-Notice’: strictly necessary, statistics and marketing. See Figure 16 below. Elsewhere, in the Data Protection Notice, STACKIT describes four categories of cookies, breaking the category above of "strictly necessary" into "technically necessary" and "preferences". 60 According to STACKIT's cookie manager descriptions, users cannot refuse strictly necessary (functional) cookies. The cookie consent manager works as intended: even when Privacy Company did not make an active choice, it only observed first party cookies from STACKIT while visiting STACKIT’s publicly accessible Knowledge Base (docs.stackit.cloud). No analytics or marketing cookies were observed. Figure 16: STACKIT cookie banner consent preferences 60 STACKIT, STACKIT Data Protection Notice: Data Protection Notice for STACKIT and the websites, services and support associated therewith, section 3.1.

Purposes and legal basis of processing, version 4.2, URL: https://www.stackit.de/en/data-protection-notice/ (page last visited 24 July 2025). At the start of this DPIA, STACKIT published version 4.0, also undated at the same URL. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 4.1 Encryption Encryption is an important security measure to protect Content Data against unauthorised access. STACKIT offers several encryption-related services:  STACKIT Confidential Server: A service to deploy confidential virtual machines that is based on CPU virtualisation features like AMD SEV-ES. STACKIT advertises the availability as on request: “ STACKIT Confidential Server is currently only available on request. If you are interested, please contact us. ” 64 Privacy Company did not include this service in the test because it was not generally available at the time of testing.  STACKIT Confidential Kubernetes: A service that allow customers to deploy confidential Kubernetes containers, based on Kubernetes Engine Constellation by Edgeless Systems. 65 Privacy Company did not include this service in the test because hosting of containers was not in scope of testing.  STACKIT Secrets Manager: A service that allows customers to manage secrets like cryptographic keys. 66 Privacy Company did not include this service in the test because key management is not in scope of the DPIA without corresponding encryption service.

The three encryption options STACKIT offers are not able to apply encryption to the combination of the three tested services. If government organisations are required to apply encryption with a self managed key (for example, in case of state secret information), they can overcome this problem by hosting the webserver inside of the encrypted VM, including storage and databases. In that case, the set-up requires more work, as they cannot use the managed database from STACKIT. Privacy Company has not tested this option, and could not easily find technical implementation documentation from STACKIT to see if the applied encryption would be effective (including use of a self-managed KMS), or external audit reports verifying the robustness of the encryption implementation. 4.2 Pseudonymisation admins As mentioned in Section 2.4.2, admins are vulnerable to spear phishing, as they may have access to many confidential data.

To protect the identity of admins, government organisation can choose to pseudonymise the account data of admins by creating generic account names (e.g. "admin1") rather than using personal names. 5. Purposes of the Processing Under the GDPR, the principle of ‘purpose limitation’ dictates that personal data may only be collected for specified, explicit and legitimate purposes, and may not be further processed in a manner that is incompatible with the initial purpose. The purposes are qualified and assessed in part B of this DPIA. This Section provides a 64 STACKIT, STACKIT Confidential Server (Preview / Limited Offering), URL: https://www.stackit.de/en/product/stackit-confidential-server/ (page last visited 21 July 2025). 65 STACKIT, STACKIT Confidential Kubernetes, URL: https://www.stackit.de/en/product/stackit-confidential-kubernetes/ (page last visited 21 July 2025). 66 STACKIT, STACKIT Secrets Manager, URL: https://www.stackit.de/en/product/stackit- secrets-manager/ (page last visited 21 July 2025) DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 5.3.4 IT Security STACKIT mentions wide ranging purposes related to IT Security in its Data Protection Notice.

STACKIT processes personal data to: o Detect incorrect login attempts, o Perform system-based evaluations of the services/features used for billing purposes as well as capacity management, optimisation purposes and ensuring operations, o Apply a rules-based evaluation for anomalies and potential security incidents in both STACKIT’s and the customer’s area of responsibility, o Perform appropriate vulnerability scans (proactive and reactive) for systems available on the Internet, o Resolve security incidents, including informing customers about necessary technical modifications, o Process complaints and security flags for abuse detection. It appears from the description of the first bullet that STACKIT qualifies itself as data controller for incorrect login attempts by admins (and as mentioned in Section 5.3.3, protecting our IT infrastructure ) hence, for the processing of Account and Diagnostic Data of government admins if they use STACKIT services.

This is no longer relevant in view of the adapted DPA. As explained in Section 3.3.4, STACKIT has also explained the data it collects via its security logs and how it prevents identifiability of individuals in these logs, for example by sampling and removing IP addresses. 5.3.5 Provide Support STACKIT provides support via a telephone hotline and via the Support portal. In the cloud service terms STACKIT specifies that support covers four purposes: o Rectifying faults o Ensuring service performance o Processing incidents o Investigating security incidents. As described in Section 3.4 STACKIT has agreed to formalise its practice in the adapted DPA that it will never access Content Data for support purposes without prior consent from the customer. 5.3.6 Newsletters, Community Forum, Webinars, trainings/learnings, social media, credit risk assessment, and data subjects’ rights According to its Data Protection Notice STACKIT has a publicly accessible Community Forum at www.community.stackit.cloud where admins can exchange experiences.

This site was not accessible during or after testing. STACKIT may have discontinued this service. Similarly, STACKIT mentions that it can send newsletters, but as shown in Figure 11, the subscription option is no longer available. These purposes are included since STACKIT may reintroduce the option to subscribe to newsletters and revive or create a Community Forum. STACKIT also describes data processing if admins participate in Webinars, trainings and learnings or communicate with STACKIT via social media. Finally, STACKIT mentions that it performs a credit risk assessment for new customers. When processing personal data for these purposes, STACKIT also has to honour data subject rights as independent data controller (mentioned as separate purpose in the Data Protection Notice). DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 59 of 117 Section 6.2 analyses if STACKIT can be qualified as a data processor, both from a formal point of view (based on the used version of the standard DPA) and from a factual analysis.

As identified in Section 5.4, STACKITs standard DPA contains some purposes where STACKIT takes factual decisions about the purposes and means of the data processing, such as a decision to anonymise or aggregate personal data. However, only data controllers may take such decisions. If a processor itself decides to further process some personal data for its own business purposes, it acts in contravention of its processor obligations. Based on Art. 28 (10) of the GDPR, the processor then becomes a data controller, but not necessarily an independent data controller. Based on the standard terms and conditions STACKIT offers (as analysed in Section 2.3), STACKIT considers itself to be an independent data controller for 16 purposes of the processing. Section 6.4 describes when STACKIT and the Dutch government organisation would have to be factually qualified as joint controllers . However, absent such a joint controller agreement, STACKIT has to be qualified as a third party for the processing of personal data for 4 of the 5 categories of personal data.

To prevent disclosure to STACKIT as a third party, STACKIT and the Dutch government have agreed on a limitative list of authorised compatible further processing purposes in the adapted DPA. This construction will be explained in more detail Section Fout! Verwijzingsbron niet gevonden. below. 6.2 STACKIT data processor 6.2.1 Legal role as data processor Based on STACKIT’s standard DPA (the version used for this DPA prior to the negotiations with SLM Rijk), STACKIT only acted as data processor for the Content Data and usage data, but not for the Account, Support and Website Data, at least not formally. 83 Based on STACKIT’s standard enrolment framework, in a role as processor STACKIT processes the personal data for 9 purposes (see Section 5.2 above). As documented in Section 2.3 STACKIT has silently changed its DPA during the writing of this DPIA, from version 2.2 to version 2.3, without any notification to the test admin.

In such changes, STACKIT can add new purposes of the processing (and new sub-processors). In reply to this observation, STACKIT wrote: “ updated versions of the STACKIT DPA only apply for contractual relationships created after the time of the update. So, there is always the possibility for a (potential) customer to check updates, purposes and subprocessors before accepting the DPA. STACKIT emphasised that it cannot update existing and already agreed DPAs without notification. 84 Two of the current 9 purposes point to a role as data controller, and not a role as data processor: 1. Optimise and develop the platform 2. Anonymise the Usage Data and process said data in anonymised form The words ‘optimise’ and ‘develop’ both have a very broad meaning. They can relate to both ‘commercial optimisation and development’ and to ‘technical improvement’ or 83 According to STACKIT this data processing was already covered by its standard DPA, even though not specified.

According to STACKIT, “ the negotiated DPA simply states these issues in a more detailed/transparent way. ” Reply STACKIT to this DPIA, 9 April 2026. 84 Reply STACKIT to this DPIA, 9 April 2026. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 objection, the Contractor will be entitled to terminate the Main Agreement and this Agreement by giving four weeks' notice, subject to the provisions of the Main Agreement. ” 88 However, based on the standard DPA STACKIT could unilaterally terminate the contract in case a customer files an objection against a new subprocessor. In other words, customers could not effectively object without risking the availability of their services. In its standard DPA STACKIT also wrote that it generally processes the personal data in the EU or European Economic Area, but with a caveat. STACKIT uses the term Customer Data, but explains this also includes ‘usage data’.

STACKIT writes: “ The Contractor may, subject to compliance with the terms of this Agreement, also process the Customer Data outside the EEA, provided the Contractor has informed the Customer in advance of the location of data processing and the requirements of Articles 44 to 48 GDPR are met, or a derogation under Article 49 GDPR applies. ” 89 This means that STACKIT could (formally) use subprocessors based in for example the USA (not a third country because of the adequacy decision from the European Commission – see Section 8 below). 90 STACKIT commits to only engage the subprocessors listed in Annex 2 of the DPA. This list contains 11 parties in Germany, Spain and the Netherlands, including 3 subsidiaries of STACKIT’s owner Schwarz Group. These parties provide development support and operational support. However, STACKIT also warns that it can engage service providers not listed in the Annex that may have incidental access to the personal data, including the Content Data.

“ The Customer hereby grants the Contractor general authorization to engage other processors for the processing of Customer Data. Annex 2 contains an overview of any other processors used at the time of entering into this Agreement. As a general rule, the engagement of service providers who inspect or maintain data processing facilities or processes or other ancillary services that do not entail the processing of Customer Data does not require any authorization, even if access to Customer Data cannot be excluded, provided that the Contractor takes appropriate measures to protect the confidentiality of Customer Data [emphasis added by Privacy Company].” 91 The phrasing could point to very incidental access by parties such as auditors or pen testers to the limited ‘usage data’, or to people that clean in a data centre, but STACKIT did not explain what parties are part of ‘maintenance of data processing facilities’ or what ‘ancillary services’ are, and why they would incidentally get access 88 STACKIT standard DPA, undated version created 17 June 2025. 89 STACKIT standard DPA, Section 2.5. 90 In reply to this observation, STACKIT commented that it has adapted a much more restricted provision in the currently valid version of its standard DPA, version 2.4.1, Section 2.5, URL: https://stackit.com/en/asset/download/34534/file/STACKIT data processing agreement.pdf?i nLanguage=eng-DE. 91 Idem, Section 7.1.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 organisation has to take decisions about both the means and the purposes of the data processing, complementing the decisions already made by the STACKIT developers. As the EDPB writes: “ Decisions can be considered as converging on purposes and means if they complement each other and are necessary for the processing to take place in such manner that they have a tangible impact on the determination of the purposes and means of the processing. ” 97 This means the intended key purposes of the processing cannot be achieved without both parties’ participation in decision-making about the purposes and means. As analysed in Section 6.2 above, based on a formal and a factual analysis, STACKIT takes decisions about the purposes and three essential means of the processing of ‘processor’ data,: 1. The engagement of subprocessors/access by ‘ancillary services’ and for support services. 2.

The right to audit. 3. Determination of data retention periods of the Account, Diagnostic, Support and Website Data. Admins must use the 3 relevant restricted access websites to perform their work duties. Since STACKIT has decided to only make some essential information for admins and legal staff public on its publicly accessible stackit.de and cloud.stackit.de pages, STACKIT forces government employees to accept data processing by STACKIT via cookies and similar technologies on both types of Websites. By choosing STACKIT as a provider for cloud services, and if they were to agree to STACKIT’s current terms and conditions, Dutch government organisations would enable STACKIT to factually take decisions as a data controller about the processing of personal data from admins, but not as an independent controller. The processing by STACKIT of the Account, Diagnostic, Support and (both types of) Website Data for the 9 remaining controller purposes (where relevant) is inextricably linked to the main purpose of the processing of the Content Data.

If Dutch government organisations were to accept processing by STACKIT as controller (with self-determined purposes and means), the Dutch government organisation would become a joint controller with STACKIT for the processing of these personal data for these purposes. As Advocate General Bot noted in his Opinion to the ECJ in the case about the use of Facebook Pages by the Schleswig Holstein Wirtschaftsakademie, parties can become joint controllers if they make the data processing possible. And their joint controllership is further evidenced by the fact that they can also decide to terminate the processing: “ By making the processing of the personal data of users of the fan page possible, the administrator is adhering to the system put in place by Facebook. (…) Inasmuch as he agrees to the means and purposes of the processing of personal data, as predefined by Facebook, a fan page administrator must be regarded as having participated in the determination of those means and purposes.

Moreover, just as a fan page administrator has a decisive influence over the commencement 97 EDPB guidelines 2020/7. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 67 of 117 of the processing of the personal data of people who visit his fan page, he also has power to bring that data processing to an end, by closing the page down. ” 98 Dutch government organisations can decide to stop using STACKIT cloud services, and thereby cause the deletion of the Content and Account Data. Hence they can take decisions to bring (some of the) data processing to an end. In reply to this observation, STACKIT wrote: “ From our point of view there is a only controllership of STACKIT . For example for running the website, cookies and so on. For the using of cloud services and connected to this relevant subprocessors for STACKIT Cloud Services, audits, support data, there is an only controllership of the Customer and STACKIT is only processor.

In none case regarding STACKIT there is a joint controllership. ” 99 To prevent unintentional joint controllership, the Dutch government follows the advice from the French National Supervisory Authority. The CNIL has published a useful explanation of how data controllers can allow data processors to process personal data for operations that are necessary for the processor’s own legitimate business purposes, without becoming joint controllers. The CNIL explains that a processor may further process data as an independent data controller, provided that the controller has assessed the processing is compatible, and that the controller explicitly authorises the processor in writing to process for these purposes. 100 The CNIL writes [informally translated by Privacy Company]: “ A data processor may only reuse personal data on its own behalf if such reuse is compatible with the initial processing and if the controller has authorised this processing in writing.

(…) The controller may, under the conditions set out below, authorise its processor to reuse the personal data on its own behalf. The processor then becomes the data controller for this new processing. (…) The data controller must determine whether such further processing is compatible with the purpose for which the data were originally collected, if the processing is not based on the data subject's consent or on a specific legal obligation .” 101 Though STACKIT states it wants to qualify as a processor for the Support Data, this was not yet clear in its standard DPA, and is contradicted by the mentioning of Account and Support Data in the Data Protection Notice (when STACKIT qualifies itself as data controller). Since STACKIT does not offer a joint controller agreement to the Dutch government as defined in Art. 26 GDPR, this DPIA assesses the data protection risks of disclosing personal data to STACKIT as a third party.

This will be analysed in Section 11.2 of this DPIA. 98 CJEU, Opinion of Advocate General Bot, Case C ‑ 210/16, ECLI:EU:C:2017:796, par. 56. 99 Reply STACKIT to part A of this DPIA, 11 July 2025. 100 CNIL, Sous-traitants : la réutilisation de données confiées par un responsable de traitement, 12 January 2022, URL: https://www.cnil.fr/fr/sous-traitants-la-reutilisation-de- donnees-confiees-par-un-responsable-de-traitement. 101 Idem. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 69 of 117 Figure 17: Worldwide market shares of cloud infrastructure providers in Q4 2024 104 STACKIT is a relatively new entrant to the cloud market, with commercial offerings starting in 2022. As a new entrant, STACKIT has a clear financial interest in increasing its market share. STACKIT also has a strong business interest in assuring customers it is not a start- up. As mentioned in Section 1.1 STACKIT evolved from the Schwarz Group's internal needs for cloud computing to support its retail businesses.

In addition, the chains rely upon STACKIT. This both creates a built-in set of established customers, and a robust financial interest in STACKIT's continuation. STACKIT advertises the fact that it is held by a family-owned company as enabling " economically and politically stable solutions. " 105 In comparison to larger cloud companies, STACKIT positions itself as " simple, secure, stable. " STACKIT thus emphasises the advantage of simplicity in contrast to competitors offering more features. Like its competitors, STACKIT has strong business ethical interests to comply with international privacy and security standards. The Schwarz Group has invested in digital security, and in privacy friendly generative AI, by acquiring the security company XM Cyber and investing in the German AI company Aleph Alpha. As owner of the grocery store chains Kaufland and Lidl, the Schwarz Group complies with both German and global security standards at the level of ‘ operator of critical infrastructures (KRITIS) ’. 106 The company has a key business interest in positioning itself as the only serious European alternative for the US American dominance.

STACKIT stresses data sovereignty as a key reason to adopt its products as " paving the way to an independent Europe ." 104 Idem. 105 STACKIT, undated, URL: https://www.stackit.de/en/ (last visited 26 May 2025) 106 Karsten Leclerque, Sitsi, The STACKIT cloud at the heart of Schwarz Group’s transformation, 24 June 2024, URL: https://sitsi.pacanalyst.com/stackit/ (last visited 26 May 2025) DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 With one in three German companies looking for an EU cloud provider, 107 many Dutch government organisations are likewise reconsidering their decisions to entrust personal data to a global cloud service provider. STACKIT advertises the benefits of an EU solution by stressing that it stores all Customer and Usage Data in Germany, and will only expand with other data centres within the EU, " in full compliance with GDPR and without compromise, for example through the adequacy decision.

" 108 With an uncertain future for the EU US adequacy decision, EU solutions also avoid the potential need to move data at a future date based on court or political decisions. STACKIT writes: " third-party access to data, for example by US authorities within the framework of the CLOUD Act, can be avoided. " 109 Finally, STACKIT notes that an added benefit of a European data cloud is that it " cannot be paralyzed by sanctions or shutdowns " from foreign actors. 110 STACKIT invests in independent verification of security, privacy and compliance controls including:  ISO 27001 (Information Security Management)  ISO 20000 (Reliability)  C5 (Cloud Computing Compliance Criteria Catalog)  TÜVIT Trusted Site  ISO 50001 (Environmental) 111 STACKIT did not (yet) provide a copy of the C5 audit to Privacy Company (the test customer). 7.2 Interests of government organisations Dutch government organisations potentially have economic and financial interests in switching from hosting in local government datacentres to hosting of data on cloud servers.

Some of the possible benefits of a switch to cloud VMs are: 1. Increased flexibility, because creating a VM and using a preconfigured database is faster and easier than installing an OS or database on a physical server. admins can clone a VM with the OS already installed. Developers and software testers can create new environments on demand to handle new tasks as they arise. 2. Cost saving, because organisations may need less staff to manage the infrastructure, and are generally less effective in maximising the amount of VMs run on a single physical computer (bare metal server). STACKIT notes that " you only pay for the services you are actually using " 112 Costs move 107 STACKIT, Data sovereignty with STACKIT, undated, URL: https://www.stackit.de/en/data- sovereign-cloud/ (last visited 26 May 2025) 108 IBID 109 STACKIT, Data sovereignty with STACKIT, undated, URL: https://www.stackit.de/en/data- sovereign-cloud/ (last visited 26 May 2025) 110 IBID 111 STACKIT, Cloud certificates STACKIT, undated, URL: https://www.stackit.de/en/cloud/certificates/ (last visited 26 May 2025) 112 STACKIT, The STACKIT pricing model – Transparent and simple, undated, URL: https://www.stackit.de/en/pricing/cloud-services/ (Last visited 26 May 2025) DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 71 of 117 from expensive upfront capital expenditures (CAPEX) to lower but ongoing operating expenditures (OPEX), which can be easier to fund.

However, in comparison to other cloud providers tested by Privacy Company, STACKIT charges much higher costs. 3. Increased reliability and availability, because it is easy to scale up computing capacity when necessary in the cloud databases, and to deploy multiple copies of the same virtual machine to better serve increases in load. Typically, it is much easier with virtualization software to reallocate hardware resources dynamically between one virtual machine and another. 4. Increased security and recovery, because the cloud VM provider has such a wide range of customers that it is able to faster detect new risks than engineers of local data centres. A globally operating cloud provider typically has more security engineers available, and 24/7, to mitigate risks. Additionally, the easy creation of VMs and databases also makes it possible to completely delete a compromised VM and then recreate it from a snapshot of the VM, hastening recovery from malware infections. 5.

Easier GDPR compliance. As described in Section 3.3.1 (audit logs), most cloud providers offer extensive logging possibilities that enable government organisations to regularly inspect the files for unauthorised access to personal data, and detect possible data breaches. However as noted, the logging features provided by STACKIT are not as extensive as others on the market. Yet because VMs are isolated from each other, it is easier to create independent user environments, for example a separate environment for software testing and external auditing. Government organisations have a strong interest in transparency, to be able to compare different services, forecast costs, to easily create an overview of different technical capacities and to assess the different privacy and security risks, including the risks of unlawful further processing through access by authorities in foreign countries, malicious state actors and hackers.

Additionally, government organisations need to prevent the possibility of ‘legacy’ and ‘vendor lock-in’. Government organisations need to have the organisational and technical ability to easily transfer their data to other suppliers over time. Many Dutch government organisations use services from Microsoft for text and number processing. It may make sense to choose a different provider than Microsoft Azure for cloud infrastructure services, also in view of the risk that Microsoft is likely to attract more threats due to its near monopoly for Office services. The Dutch government Audit Office has explicitly warned the Dutch government about this risk. 113 Finally, it is in the government organisations’ interest that the platform is easy to use, so that employees who have little knowledge of IT can work with it. From a cost saving interest, it is important that the platform offers many good standard options, so that the government organisation does not need to develop much of its own functionality. 7.3 Joint interests The interests of STACKIT and the Dutch government align when it comes to the protection of the integrity, availability, and reliability of Content Data in the cloud VM servers, databases and storage, as well as high scalability and flexibility of the deployment of the cloud services. 113 Auditdienst Rijk, Onderzoeksrapport Bevindingen onderzoeksopdracht 'Evaluatie public cloudbeleid Rijksoverheid', 3 July 2024, URL: https://www.tweedekamer.nl/downloads/document?id=2024D38837 DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 The interests of STACKIT and the Dutch government also align with regard to the interest in strong security.

As part of the shared security interest, STACKIT's creation of its own security logs and use of network and webserver access log files to detect security risks also concurs with the interests of the Dutch government organisations, provided that STACKIT performs the monitoring based on aggregated data, and does not store the personal data in these logs longer than strictly necessary for these security purposes. STACKIT could however offer more logging options to help Dutch government organisations detect any security issues. The interests of STACKIT and Dutch government organisations also align when it comes to strategical issues of sovereignty and autonomy. The three hyperscalers that offer combined Infrastructure, Software and Platform services are all based in the USA, and their use always involves international data transfers to data centres and engineers in third countries. STACKIT's status as a German company, with decisions to hold data in Germany and to use open source technologies, aligns well with current geopolitical risks, except for STACKIT’s engagement of subprocessors outside of the EU.

The Dutch government will present a revised Cloud Policy to parliament this year, narrowing down the current policy 114 , and implementation guidance 115 that use of public cloud service is allowed, based on a risk assessment, compliance with BIO and in accordance with C2000 criteria for risks regarding espionage, influencing or sabotage by state actors or other third parties. 116 This new policy is the result of intense debate in the Dutch parliament, and in media, about digital sovereignty. The Dutch parliament has drafted a Bill about digital sovereignty 117 and the Rekenkamer has published a report about public cloud usage. 118 The Dutch government replied to this parliamentary initiative with the commitment to tighten requirements for the use of public cloud services. In the translation of Privacy Company: “ This has the consequence that fewer central government digital services may be developed in the public cloud, depending on the interests to be protected.

For such services it should be investigated whether a sovereign government cloud can be set up .” 119 114 Brief van de Staatssecretaris van Binnenlandse Zaken en Koninkrijksrelaties, Rijksbreed cloudbeleid 2022, 29 August 2022, URL: https://open.overheid.nl/documenten/ronl- a79331dc7c088f2cb6259f591c3b4f2fbcc9b5f1/pdf. 115 Rijksoverheid, Implementatiekader risicoafweging cloudgebruik, versie 1.1, 5 January 2023, URL: https://open.overheid.nl/documenten/ronl- 734f947ec6465e4f75a56bed82fe64a1135f71a8/pdf. 116 Kamerstukken II 2018/19, 25 124, nr. 96. 117 Six Dijkstra en Kathmann, Wolken aan de horizon, URL: https://www.rijksoverheid.nl/documenten/publicaties/2024/06/18/initiatiefnota-wolken-aan- de-horizon 118 Algemene Rekenkamer, Het Rijk in de Cloud, Donkere wolken pakken samen, 15 januari 2025, URL: https://www.tweedekamer.nl/downloads/document?id=2025D01084 119 Kamerbrief staatsecretaris en minister van Economische Zaken over de Initiatiefnota ‘Wolken aan de horizon’, 17 January 2025, p. 1-2, URL: https://open.overheid.nl/documenten/71103a99-b696-42fd-b34a-c83f979b3201/file.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 73 of 117 8. Transfer of personal data outside of the EU STACKIT stores all data in German data centres. 120 STACKIT writes in the Service specific Cloud terms that it will only expand within the EU: “ The STACKIT Cloud Services are provided and operated in the STACKIT data center in Germany and in the future also in other member states of the European Union. ” 121 Analysis of the potential transfer of personal data outside of the EU is therefore limited to transfers to, and by subprocessors. The GDPR contains specific rules for the transfer of personal data to (sub) processors or controllers in third countries without an adequate level of protection. The adequacy can be determined in a number of ways: a multinational may adopt Binding Corporate Rules, apply the EU Standard Contractual Clauses (SCC) or only transfer to countries for which the European Commission has taken a so-called adequacy decision (such as the USA since June 2023).

In its standard DPA STACKIT relies on SCC’s for transfers to subprocessors, the EU Standard Contractual Clauses (processor to processor, as revised in 2021). The SCCs contractually ensure a high level of protection. 8.1 Transfers of personal data via subprocessors Below two types of data transfers are described based on STACKIT’s standard enrolment framework: by STACKIT as processor (for the Content and Diagnostic Data, based on STACKIT’s standard DPA), and by STACKIT as controller (for the Account, Support and two types of Website Data), as based on STACKIT’s public Data Protection Notice. STACKIT has since agreed with the Dutch government on exclusion of data transfers for the contracted services – see the box with mitigating measures below. 8.1.1 Transfer of Content and Diagnostic Data Based on the standard DPA, as processor STACKIT has options allowing customers to geographically limit the processing of their Content Data to specific regions which, as discussed, are currently all in Germany.

In the standard DPA, the category of ‘Usage data’ is included in STACKIT’s term of ‘Customer Data’. Therefore Privacy Company assumed that the Diagnostic Data (audit logs, service generated server logs and security logs) are also exclusively processed in Germany. STACKIT describes in its standard DPA that it can use subprocessors based in for example the USA (not a third country because of the adequacy decision from the European Commission). STACKIT’s list of subprocessors only contained parties based in the EU that provide development support and operational support. However, as quoted in Section 6.2.2, STACKIT also warns that it can engage service providers not listed in the Annex that may have incidental access to the Content and Diagnostic Data. It was not clear what this access entails, or from what countries. 120 STACKIT, Regions and Availability Zones, undated, URL: https://docs.stackit.cloud/stackit/en/regions-and-availability-zones-75137212.html (page last visited 22 May 2025) 121 STACKIT, Service Description STACKIT Cloud, undated, URL: https://www.stackit.de/en/general-terms-and-conditions/service-description/ .

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 In view of the limited scope of this DPIA, other legal obligations or frameworks (for example in the area of information security, such as BIO) are not included in this report. The act of reading or placing information (through cookies or similar technology), or enabling third parties to read information from the devices of end users triggers the applicability of Article 5(3) of the ePrivacy Directive, regardless of who places or reads the information, and regardless of whether the content is personal data or not. Consent is required prior to the retrieval or storage of information on the devices or browsers of end users, unless one of the exceptions applies, such as the necessity to deliver a requested service, or necessity for the technical transmission of information. Based on article 3(1) of the GDPR, because the data processing takes place in the context of the activities of data controllers (Dutch government organisations), the GDPR applies to all phases of the processing of these data.

Applicability of the GDPR rules does not exclude applicability of the ePrivacy rules or vice versa. The European Data Protection Board writes: “Case law of the Court of Justice of the European Union (CJEU) confirms that it is possible for processing to fall within the material scope of both the ePrivacy Directive and the GDPR at the same time. In Wirtschaftsakademie, the CJEU applied Directive 95/46/EC notwithstanding the fact that the underlying processing also involved processing operations falling into the material scope of the ePrivacy Directive. In the pending Fashion ID case, the Advocate General expressed the view that both set of rules may be applicable in a case involving social plug-ins and cookies. ” 130 Article 5(3) of the ePrivacy Directive was transposed in article 11.7a of the Dutch Telecommunications Act. The consequences of the so-called cookie provision are far- reaching, since it requires clear and complete information to be provided *prior* to the data processing, and it requires consent from the user, unless one of the legal exceptions applies.

The consent is identical to the consent defined in the GDPR. The ePrivacy rules apply to three types of data processing by STACKIT: 1. Telemetry Data 2. Cookies and similar technology on the website 3. Tracking pixels and beacons in newsletters Privacy Company did not observe any Telemetry Data sent to STACKIT or any third- party domains from any visited STACKIT domain. As described in Section 3.5, STACKIT applies privacy by default on both types of Websites, and only sets and reads functional cookies. STACKIT uses two different but effective consent mechanisms on its restricted and publicly accessible websites. Though STACKIT has a Cookie Policy with documentation about some cookies, the documentation is incomplete. Some documentation can only be found in STACKIT’s 130 EDPB, Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities, adopted on 12 March 2019, Paragraph 30.

URL: https://edpb.europa.eu/sites/edpb/files/files/file1/201905 edpb opinion eprivacydir gdpr interplay en 0.pdf In footnotes the EDPB refers to: CJEU, C- 210/16, 5 June 2018, C ‑ 210/16, ECLI:EU:C:2018:388. See in particular paragraphs 33-34 and the Opinion of Advocate General Bobek in Fashion ID, C-40/17, 19 December 2018, ECLI:EU:C:2018:1039. See in particular paragraphs 111-115. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 77 of 117 Data Protection Notice. Despite testing without accepting any optional cookies, Privacy Company observed undocumented traffic and cookies to and from other parties, namely Atlassian, Atlassian's partner MiniOrange 131 and Cloudflare. As described in Section 3.2.2 STACKIT initially offered an option to subscribe to newsletters. STACKIT describes in its Data Protection Notice it uses tracking pixels and beacons in newsletters, that enable STACKIT to observe individual reading, forwarding and interaction behaviour such as clicking on a hyperlink.

The use of such a tracking pixel requires prior, informed consent. However, STACKIT has since removed the option to subscribe to the newsletter. 10. Retention Periods 10.1 Retention periods for Content Data Government organisations themselves determine to a large extent the retention periods of Content Data in the tested services. Customers can delete specific Content Data, or for example, terminate an entire VM. However, STACKIT applies a default fail-safe retention period of 30 days to the Cloud Storage. 132 10.2 Retention period for Diagnostic, Account, Support and Website Data In its standard DPA STACKIT mentions it retains Diagnostic Data as long as the agreement is in place. STACKIT writes in Section 2.4: “ The duration of processing shall correspond with the term of the Main Agreement. ” 133 STACKIT did not mention retention periods for the other three identified categories of personal data (Account, Support and Website Data) it processes in its standard Data Processing Agreement, and not in the Cloud Terms of Use, or the Service Description STACKIT Cloud.

STACKIT does describe different retention periods for different kinds of personal data in its Data Protection Notice (when STACKIT qualifies itself as data controller), but these descriptions are not always clear. For example, STACKIT mentions a storage period of 90 days of logs for ‘IT security purposes’. STACKIT replied to this part A of the DPIA with the explanation that ‘logs’ does not refer to the security logs in STACKIT’s own SIEM logs. 134 Therefore, this DPIA assumes STACKIT refers to the audit logs available to admins, as a subset of Diagnostic Data. STACKIT explained that there is no uniform retention period for its own SIEM logs: “ Logging data is deleted when it is no longer required to achieve its purpose .” 135 131 MiniOrange, MiniOrange Security Software, undated, URL: https://www.miniorange.com (last visited 23 May 2025). 132 STACKIT, STACKIT Data Protection Notice: Data Protection Notice for STACKIT and the websites, services and support associated therewith, section 7.4.

Storage time, Version 4.2, undated, URL: https://www.stackit.de/en/data-protection-notice/ (last visited 25 July 2025). Confirmed in the Cloud services terms of use, section 5.7. 133 STACKIT standard DPA version 2.3, undated, but created 17 June 2025. 134 Idem. 135 Reply STACKIT to part A of the DPIA, 11 July 2025. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Part B. Lawfulness of the Data Processing This second part of the DPIA assesses the lawfulness of the data processing. This part contains a discussion of the legal grounds, an assessment of the necessity and proportionality of the processing, and of the compatibility of the processing in relation to the purposes. 11. Legal Grounds To be permissible under the GDPR, processing of personal data must be based on one of the grounds mentioned in Article 6 (1) GDPR. Essentially, for processing to be lawful, this article demands that the data controller bases the processing on the consent of the user, or on a legally defined necessity to process the personal data.

The assessment of available legal grounds (sometimes called ‘lawful bases’) is tied closely to the principle of purpose limitation. The EDPB notes that “ The identification of the appropriate lawful basis is tied to principles of fairness and purpose limitation . [.] When controllers set out to identify the appropriate legal basis in line with the fairness principle, this will be difficult to achieve if they have not first clearly identified the purposes of processing, or if processing personal data goes beyond what is necessary for the specified purposes. ” 147 Thus, in order to determine whether a legal ground is available for a specific processing operation, it is necessary to determine for what purpose(s), the data was or is collected and will be (further) processed. There must be a legal ground for each of these purposes. The grounds mentioned in Article 6 (1) GDPR are as follows: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes. b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. c) processing is necessary for compliance with a legal obligation to which the controller is subjected. d) processing is necessary in order to protect the vital interests of the data subject or of another natural person. e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The appropriate legal ground depends on STACKIT's role as processor, or as (authorised) data controller. The four relevant legal grounds are, in short: consent, contract with the data subject, legal obligation, public interest and legitimate interest. 147 EDPB, Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects - version adopted after public consultation, 16 October 2019, URL: https://edpb.europa.eu/our-work-tools/our- documents/guidelines/guidelines-22019-processing-personal-data-under-article-61b en. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 81 of 117 The legal grounds of vital interest and legal obligation are not discussed, since nor STACKIT nor the Dutch government organisations have a vital (lifesaving) interest in processing personal data via STACKIT’s cloud services.

Additionally, there is no (specific) legal obligation for the Dutch government to use STACKIT (or any comparable cloud services). As explained in Section 6, based on a factual analysis STACKIT initially (based on its standard terms) could not be qualified as data processor for all identified purposes for the five identified categories of personal data. The five categories of personal data are: 1. Content Data (called Customer Data by STACKIT 148 ) 2. Account Data, in two types: o admin account data o Contact Data from procurement officers 3. Diagnostic Data 4. Support Data (both the contents of support tickets and metadata) 5. Website Data, in two types: o the restricted access websites, i.e. the Login Portal, the Support Portal, the admin console and the server management console. o the publicly available stackit.de and stackit.cloud pages with documentation, knowledge base and legal information.

As described in Section 6.2, based on its standard DPA in combination with the public Data Protection Notice, STACKIT only qualified as data processor for the Content and Diagnostic Data, for 5 of the 7 identified purposes. This DPIA concluded, based on a formal analysis of the applicable terms, STACKIT had to be qualified as controller for the other purposes/other personal data. As mentioned earlier in this DPIA, STACKIT disagrees with this conclusion, and insists it already was a processor for most of the data processing. Section 6.3 concludes that STACKIT could not be qualified as independent data controller. As described in Section 6.4, absent an (undesirable) joint controller agreement, STACKIT would qualify as third party for the processing of the Account, Support and Website Data for the 7 identified ‘processor’ purposes plus the purposes related to STACKIT’s own business operations.

However, the ‘further’ processing of personal data for these purposes was incompatible with the original purposes for which STACKIT collected and generated the data. The detailed compatibility analysis has been removed from this public version of the DPIA, as it is no longer relevant in the context of the negotiated new DPA with the Dutch government. Finally, for the purposes mentioned in Section 5.3.6, STACKIT can legitimately act as an independent data controller , without risking factual joint controllership. This applies to the processing of personal data relating to analytic and marketings cookies, to engagement with the Community Forum and the sending of commercial newsletters with tracking pixels, if STACKIT enables or revives those types of data processing. Similarly, STACKIT can legitimately act as an independent data controller for the processing of the Commercial Contact Data for customer relationship management purposes, including credit and risk assessment of new customers, but only if STACKIT excludes processing of data from admins for these commercial purposes.

This also applies to voluntary participation in Webinars, trainings and learnings or 148 STACKIT standard DPIA, version 2.2, undated, URL: https://www.stackit.de/wp- content/uploads/2025/05/STACKIT AV-Vertrag STACKIT-Cloud-Services- 2.2 englisch 202505.pdf?x26150 DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 communication with STACKIT via social media. As independent data controller for the processing of personal data, STACKIT also has to honour data subject rights (mentioned as separate purpose of the processing in STACKIT’s Data Protection Notice.) This DPIA does not assess STACKIT’s legal ground for the processing of personal data for these 9 purposes, as this is the exclusive responsibility of STACKIT. 11.1 Legal grounds government organisations [STACKIT processor] 11.1.1 Consent Article 6(1)(a) GDPR reads: “ the data subject has given consent to the processing of his or her personal data for one or more specific purposes ” Article 4(11) GDPR defines consent as “ consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. ” Consent generally is not available as legal ground for government organisations in relation to data processing of their employees, in view of the power imbalance.

The only exception is the use of cookies. For the consent to be valid, the default settings must be privacy protective, and the website must effectively enable visitors to give free, specific and informed consent. STACKIT applies privacy by default on the restricted access Website for which it acts as processor in the new DPA with the Dutch government and does not apply any misleading (dark pattern) design in the cookie consent manager. STACKIT has also improved the public cookie information. In that context, STACKIT can obtain valid consent from admins that wish to accept analytics cookies. Since STACKIT is an independent controller for the publicly accessible Website Data and for the Feedback Data, the legal ground is the exclusive responsibility of STACKIT. STACKIT does commit in the new DPA to maintain privacy by default on its publicly accessible website 11.1.2 Contract Article 6 (1) (b) GDPR reads: “ processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. ” Government organisations may require employees with admin roles to work with the tested STACKIT services to carry out the tasks included in their job description.

As described in Section 7.2, Dutch government organisations have various potential interests in using the STACKIT services, including data sovereignty, increased flexibility, cost saving and security reasons. As described in Section 5.2, it follows from the newly negotiated enrolment framework with the Dutch government that STACKIT will process the 5 categories of personal data as processor (except for the publicly accessible Website Data), for 7 specific and legitimate purposes, including security and support. This means government organisations can rely on the legal ground of necessity for the performance of the job contract with admins: as the processing is necessary in relation to the account and usage data of each admin. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 83 of 117 In sum , based on the improved enrolment framework with STACKIT, the Dutch government can justify the necessity of the processing of the five categories of personal data for the 7 identified ‘processor’ purposes. 11.1.3 Necessity for a public interest Article 6 (1) (e) GDPR reads: “ processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. ” The use of cloud storage and database tools can be necessary to perform tasks carried out by government organisations in the public interest, certainly if it involves direct interaction with members of the public/inhabitants.

As the EDPB notes in a letter to the European Commission on the use of contract tracing apps relating to the COVID- 19 pandemic, " When public authorities provide a service, based on a mandate assigned by and in line with requirements laid down in law, it appears that the most relevant legal basis for the processing is the necessity for the performance of a task for public interest. ” 199 It is up to government organisations to decide if they want to rely on the legal ground of public interest for the processing of specific Content Data in combination with the necessity to perform the (employment)contract and, as will be assessed below, perhaps also for the necessity for the legitimate interest of the government organisations. 11.1.4 Legitimate interest Article 6 (1) (f) GDPR reads: “ processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ” The last sentence of Article 6(1) of the GDPR excludes the application of the legitimate interest ground for processing carried out by public authorities in the performance of their tasks.

However, government organisations may still invoke this legal ground for necessary and proportionate data processing by cloud providers. Public sector organisations may process personal data in a different (private entity) role, outside of the tasks they carry out in the public interest, for example, when they hire office space or pay salaries to employees. The choice to use certain cloud services is secondary to the performance of public tasks and can be considered as a task primarily exercised under private law. Recital 47 of the GDPR explains: “ Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller . ” Whether a government organisation can successfully invoke the legal ground of necessity for its legitimate interest for the processing of their own logs and Content Data, must be assessed on a case-by-case basis.

The proportionality of the processing plays a crucial role. This will be elaborated in Section 14.1 of this report. In any event, government organisations must ensure “ that the interests or the fundamental rights and freedoms of the data subjects are not overriding, taking into account the DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 85 of 117 Since effective data anonymisation is very difficult to achieve, especially over time in relation to new incoming identifiable data, SLM agreed with STACKIT on the aggregation and pseudonymisation (not ‘anonymisation’) of data for STACKIT’s own technical forecasting, bookkeeping and security purposes, in purposes 1 to 4. The legitimacy of this further processing is assessed following the criteria for further processing from Article 6(4) GDPR. That provision mentions five criteria that organisations should at least test against: a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; c) the nature of the personal data , in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; d) the possible consequences of the intended further processing for data subjects; e) the existence of appropriate safeguards , which may include encryption or pseudonymisation.

Below, the compatibility of the 6 applicable ‘further processing’ purposes is discussed in 4 grouped sections. 11.2.1 Process aggregated Diagnostic, Account and Support data for internal billing, account & relationship management, internal reporting and security purposes Under a ( link ), the use of aggregated data for the agreed legitimate business purposes, including billing and forecasting, is directly related to the government's interests in maintaining a future-proof financially healthy supplier. The processing of aggregated Diagnostic Data and Support Data to keep the cloud infrastructure secure is directly related to the government's interests in a thoroughly secured and well functioning STACKIT cloud infrastructure. Under b ( relationship ), STACKIT is formally authorised to process these aggregated data as data controller. By giving this instruction the Dutch government organisation formally takes the decision about the (compatibility of the) purposes of the processing.

Under c ( nature ) the adapted DPA only permits aggregation of activities to a very high non-identifiable level of for example all Dutch government customers, or all Dutch or European Enterprise users. Aggregation for these first 4 agreed purposes should not involve processing of sensitive or special categories of personal data, unless such Content Data are part of a support ticket filed by an admin (but government organisations can prevent or terminate such processing by giving instructions and using the deletion options). Under d ( consequences ), further processing may result in loss of control and loss of confidentiality of sensitive (admin) Account Data of government organisation employees if STACKIT were to create reports about the login-habits of admins and publish such statistics relating to a specific ministry. Given the agreed high level of aggregation and STACKIT’s own data minimisation measures, STACKIT cannot and may not publish statistics about for example the inferred geolocation of visitors to a website hosted on a VM, or statistics about security incidents per tenant.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Under e ( safeguards) as authorised data controller STACKIT can only process (pseudonymised) personal data when strictly necessary and proportionate for the agreed legitimate business interests. STACKIT is explicitly prohibited from taking any decisions about further processing for other purposes. Additionally, the adapted DPA specifically excludes processing for advertising, profiling, data analytics, market research, and AI training purposes, unless the customer explicitly instructs STACKIT to process for such purposes. In sum , STACKIT's further processing of aggregated Account, Diagnostic, Support and Website Data for the first 4 purposes is compatible with the purposes for which STACKIT receives and generates data as a processor. 11.2.2 Process limited identifiable Diagnostic and Support Data for abuse detection Under a ( link ), STACKIT can only process personal data for this essential purpose if it obtains those data from its customers via support tickets, as well as its security logs and service generated server logs.

As processor STACKIT must comply with the security requirements from Art. 32 GDPR, and help customers comply with these legal requirements. The use of limited complaints and security flags in Diagnostic Data and Support Data for this purpose is directly related to the government's interests in a thoroughly secured and well functioning STACKIT cloud infrastructure. Under b ( relationship ), this processing is included in the adapted DPA with the Dutch government as authorised further processing purpose, but only to the extent the processing of personal data for this purpose is strictly necessary, and STACKIT cannot suffice with aggregated or pseudonymised data. In reply to this DPIA STACKIT has clarified what data it collects in its network infrastructure security logs, and what steps it takes to minimise the data collection. See the block at the end of Section 3.3.4. Thanks to these assurances and explanations, the Dutch government can exercise sufficient control over this further processing by STACKIT.

Under c ( nature ), if STACKIT processes complaint or abuse flags relating to specific IP addresses or tenants from Dutch government customers, the data can be sensitive, if they for example qualify behaviour from a specific government employee as abusive. Support tickets can include such sensitive or confidential data, given the option for admins to upload attachments. Under d ( consequences ), STACKIT’s further processing of Diagnostic and Support Data may result in temporary blocking of access to the VM, object storage or database service if STACKIT identifies an activity as suspicious. STACKIT may also be forced to take immediate action (stop relaying mails in case of a spam complaint for example) in reply to an abuse flag, but it is unlikely that this has a high impact on employees of the government organisation. Under e ( safeguards ), the government has agreed with STACKIT to only process personal data for this purpose if strictly necessary, and only if STACKIT cannot suffice with the processing of pseudonymised or aggregated data.

In sum , the further processing of limited Diagnostic and Support Data for abuse detection by STACKIT is inevitable, legally necessary and compatible with the purposes for which STACKIT receives data as a processor. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 87 of 117 11.2.3 Process identifiable Support Data for billing and legal self defence Under a ( link ), STACKIT's processing of Support Data outside of the processor instructions is not directly in the interest of the government organisations, but STACKIT has explained that this may sometimes be necessary if customers (wrongly) use the support channel for legal disputes or claims related to billing, or similar legal/commercial disputes. Under b ( relationship ), STACKIT is formally authorised to process these wrongly filed Support Data as data controller. By giving this instruction the Dutch government organisation formally takes the decision about the (compatibility of this) purpose of the processing.

Under c ( nature ) Support Data can include sensitive or special categories of personal data as attachment to a support ticket filed by an admin. Under d ( consequences ), the further processing may result in loss of control and loss of confidentiality of sensitive (admin) Account Data of government organisation employees and possibly Diagnostic Data from other employees included as attachments to support tickets. Under e ( safeguards) as authorised data controller STACKIT can only process the Support Data for this purpose when strictly necessary and proportionate for this legitimate business interest. STACKIT is explicitly prohibited from taking any decisions about further processing for other purposes. Additionally, the adapted DPA specifically excludes processing for advertising, profiling, data analytics, market research, and AI training purposes, unless the customer explicitly instructs STACKIT to process for such purposes.

Government organisations can prevent or terminate processing for this purpose by giving instructions not to file legal disputes via the support channel but via account management. In sum , STACKIT's further processing of the Support Data for Billing and managing Customer requests that do not fall under the processor instruction is compatible with the purposes for which STACKIT receives and generates data as a processor, in view of the strong safeguards. 11.2.4 Process identifiable data from the 5 categories for compliance with legal obligations Under a ( link ), STACKIT's legal obligations as a processor (under German law) to disclose personal data to government authorities are unrelated to the purposes for which government organisations instruct STACKIT to process personal data. Under b ( relationship ), the adapted DPA with the Dutch government includes clear steps and commitments to ensure that the likelihood of STACKIT disclosing personal data in response to an order from a government authority is minimised.

As explained in the mitigating measures at the end of Section 5.3.2, STACKIT commits to forward orders to its customer, ‘ use all available lawful efforts to challenge the order’ if forwarding is not an option, and only disclose the minimum necessary data. STACKIT additionally commits to unconditionally reject all demands made under non-EU law. 149 STACKIT has also explained that it does not process admin Account Data to comply with mandatory sanction lists, only the Commercial Contact Data (for which STACKIT is a data controller, out of scope of this DPIA). 149 Adapted DPA, Section 3.2. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Thanks to these assurances, the Dutch government can exercise sufficient control over this further processing by STACKIT. Under c ( nature ), STACKIT may be compelled to provide available personal data about an individual admin or government organisation to an EU government authority.

Such further processing does not require a compatibility test if the further processing is required by EU/EU Member State law. Article 29 GDPR creates a specific exception for processors: “ The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. ” 150 However, there is no such exception for disclosure of personal data to government authorities outside of the EU, and the requested data may include sensitive and special categories of personal data if these are part of unencrypted content stored on the VM, Object Storage or in the MariaDB database. Under d ( consequences ), disclosure of personal by STACKIT to a government authority outside of the EU could have an enormously high impact on a data subject, especially if it involves sensitive or special categories of personal data of employees of the government organisation or possibly external data subjects (if their data are included in the hosted database).

Under e ( safeguards ), as mentioned under (b) STACKIT will unconditionally reject every request or order from a non-EU authority for disclosure of personal data from customers it processes as processor. Additionally, STACKIT has committed in the adapted DPA to publish statistics about orders/requests it receives, at least annually. In sum , based on the new contract with the Dutch government, with the adapted DPA, the further processing of the Content Data, Account Data, Diagnostic Data, Support Data and Website Data by STACKIT for the 6 authorised purposes is compatible with the purposes for which STACKIT receives data as a processor. 12. Special categories of personal data As explained in section 2.2.1 of this DPIA ( Content Data ), it is up to the individual government organisations to determine if they process special categories of data on a STACKIT VM, Object Service or MariaDB. Special categories of data are: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person's sex life or sexual orientation or data relating to criminal convictions and offences.

(Art. 9(1) GDPR). Additionally, based on Article 10 GDPR, the processing of personal data relating to criminal convictions and offences or related security measures is similarly restricted. Potential disclosure or unauthorised access to special categories of data can have a very high negative impact on data subjects. Government organisations must take all the circumstances of the use of a cloud service for special categories of data into account to assess the probability of this risk. 150 Art. 29 GDPR, as mentioned by STACKIT in its 9 April 2026 reply to this DPIA. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 89 of 117 There is a very low probability that STACKIT will be compelled to provide access to these data to non- EU authorities, since the data processed by the services tested in this DPIA are exclusively stored in datacentres in the EU, and under EU legal jurisdiction.

STACKIT has also given the unconditional commitment in the adapted DPA to refuse disclosure to non-EU government authorities. If government organisations decide to use other services, out of scope of this DPIA, data can be processed outside of the EU. In that case, the government organisation must assess the probability of potential transfer in the clear to third countries when they decide to store special categories of data on STACKIT’s servers. According to Use case 6 of the final version of the EDPB Recommendations on measures that supplement transfer tools, encryption cannot be considered a sufficient measure if the encryption keys are accessible to STACKIT. As explained in Section 4.1 government organisations can host a webserver inside of an encrypted VM, including storage and databases. However, Privacy Company has not tested this option, and could not easily find technical implementation documentation from STACKIT to see if the applied encryption would be effective (including use of a self-managed KMS), or external audit reports verifying the robustness of the encryption implementation.

The data protection risks for data subjects are not limited to the processing of special categories of data. Similar risks may apply to other categories of personal data of a sensitive nature, classified or secret data. The EDPS explains in its guidelines on the use of cloud computing services by European institutions that special categories of data should be interpreted broadly when interpreting the risks for data subjects. The EDPS writes: “ Nevertheless, this is not the only factor determining the level of risk. Personal data that do not fall under the mentioned categories might lead to high levels of risk for the rights and freedoms of natural persons under certain circumstances, in particular when the processing operation includes the scoring or evaluation of individuals with an impact on their life such as in a work or financial context, automated decision making with legal effect, or systematic monitoring, e.g. through CCTV.

“ 151 The EDPS also refers to the criteria provided by the Article 29 Working Party when a Data Protection Impact Assessment (DPIA) is required. 152 Government organisations must also consider the risk that special categories of data (or otherwise sensitive, confidential or secret data) could end up in Support Requests filed by system administrators. Similarly, some Admin Account Data and Diagnostic Data may be confidential, if it is strictly confidential what employees work for a specific government organisation. The most important mitigating measure against unauthorised disclosure by STACKIT is the procedure agreed in the adapted DPA for disclosures, and STACKIT’s commitment to publish annual transparency statistics. A mitigating measure government organisations can take themselves to lower the probability of compelled 151 EDPS, Guidelines on the use of cloud computing services by the European institutions and bodies, 10 March 2018, URL: https://edps.europa.eu/sites/edp/files/publication/18-03- 16 cloud computing guidelines en.pdf. 152 The EDPB has adopted the Article 29 Working Party guidelines WP 248 rev.01, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 disclosure of sensitive categories of data in the Account and Support Data is to pseudonymise the admin account data. 13. Purpose limitation The GDPR obliges data controllers to comply with the principle of purpose limitation. The principle of purpose limitation is that data may only be “ collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ” (Article 5 (1) (b) GDPR). Essentially, the above means that the controller must have a specified purpose for which he collects personal data and can only process these data for purposes compatible with that original purpose, unless the controller can meet additional requirements before any further processing can take place.

Data controllers must be able to prove based on Article 5(2) of the GDPR that they comply with this purpose limitation principle (accountability). Data controllers cannot comply if they engage a cloud provider as data processor, but ignore that that provider also reserves the contractual right to process the personal data for its own purposes, in its own commercial business interest. As described in Section 5.3 this DPIA identified 16 processing purposes for the Account, Diagnostic (minus the audit logs), Support and two types of Website Data, with STACKIT in a role as independent controller. Section 6.3 analyses that STACKIT can only legitimately qualify as independent (not unintentional joint) controller for the following 7 purposes: sending of newsletters, participation in Community Forum, organising Webinars, trainings/learnings, communication via social media, performing a credit risk assessment, and helping data subjects to exercise their rights relating to processing for these purposes.

Since, the Dutch government has agreed with STACKIT on an improved framework with a limitative list of processor and authorised further processing purposes. As analysed in Section 11.1 processing for the agreed specific processor purposes is necessary for the execution of the contract with admins, respectively fulfilment of a legitimate interest or public task. As analysed in Section 11.2 the further processing of specific personal data, generally aggregated, for the agreed specific purposes is compatible with the agreed data collection purposes. The principle of purpose limitation is closely linked to transparency and ‘fairness’ of the processing. Together, implementation of these principles should lead to surprise minimisation for the government organisations. As the Article 29 Working Party wrote in its guidelines on transparency (adopted by the EDPB): “A central consideration of the principle of transparency outlined in these provisions is that the data subject should be able to determine in advance what the scope and consequences of the processing entails and that they should not be taken by surprise at a later point about the ways in which their personal data has been used.

This is also an important aspect of the principle of fairness under Article 5.1 of the GDPR and indeed is linked to Recital 39 which states that DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 91 of 117 “[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data(...).” 153 It follows that government organisations must be able to inform their admin employees for what specific purposes their personal data will be processed, and be able to inform other persons whose personal data may be processed as part of the Content Data and as a result of capturing their IP addresses in the security logs about the agreed purposes, both when STACKIT qualifies as processor, and as data controller. As described in the boxes with mitigating measures taken by STACKIT in Sections 5.2 and 5.3 the adapted DPA clearly lists for what purposes STACKIT processes the different categories of personal data.

Additionally, as mentioned in the box at the bottom of Section 3.3.4, STACKIT has also provided detailed information about the raw data it collects in security logs and webserver access logs. STACKIT has explained how it minimises the data collection, by a combination of sampling and not storing IP addresses for general security purposes, and by not collecting cookie information in the webserver access logs. Finally, STACKIT has agreed in the adapted DPA to an explicit list of prohibited data processing purposes: related to advertising, marketing, profiling and use of personal data to train AI. Dutch government organisations that want to use the tested STACKIT services can use this DPIA and the adapted DPA to update their register of processing activities and inform the relevant employees accordingly. The Dutch government is able to verify STACKIT’s compliance with the agreed purposes based on the extensive audit right in the adapted DPA.

Based on the new agreement with the Dutch government, and the right to audit, government organisations are able to comply with Article 5(2) of the GDPR, and prove they comply with the principle of purpose limitation (accountability). In sum , based on the adapted DPA with agreed limitative lists of agreed purposes, and agreement on key terms such as anonymisation and aggregation, STACKIT’s data processing for the tested services is in line with the requirement of purpose limitation, both as processor and as authorised data controller. 14. Necessity and proportionality Article 5(1)c GDPR requires that every processing has to be limited to what is necessary to achieve the set purpose(s). It is therefore important to examine whether every processing is in fact necessary for the purposes for which the data controllers process personal data. The concept of necessity is made up of two related concepts, namely proportionality and subsidiarity.

The personal data which are processed must be necessary for the purpose pursued by the processing activity. First, it has to be assessed whether the same purpose can reasonably be achieved with other, less invasive means. If so, these alternatives have to be used. Second, proportionality demands a balancing act between the interests of the data subject and the data controller. Proportionate data processing means that the amount 153 The EDPB has adopted the Article 29 Working Party guidelines WP 260 rev 1, Guidelines on transparency under Regulation 2016/679, adopted on 29 November 2017, as last Revised and Adopted on 11 April 2018, Par. 41. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 of data processed is not excessive in relation to the purpose of the processing. If the purpose can be achieved by processing fewer personal data, then the amount of personal data processed should be decreased to what is necessary.

Therefore, essentially, the data controller may process personal data insofar as is necessary to achieve the purpose but may not process personal data he or she may do without. The application of the principle of proportionality is thus closely related to the principles of data protection from Article 5 GDPR. 14.1 Assessment of the proportionality The key questions are: are the interests properly balanced? And, does the processing not go further than what is necessary? To assess whether the processing is proportionate to the interest pursued by the data controller(s), the processing must first meet the principles of Article 5 of the GDPR. As legal conditions they have to be complied with in order to make the data protection legitimate. 154 Data must be ‘ processed lawfully, fairly and in a transparent manner in relation to the data subject ’ (Article 5 (1) (a) GDPR). This means that data subjects must be informed about the processing of their data, that all the legal conditions for data processing are adhered to, and that the principle of proportionality is respected.

Below, these conditions are elaborated in three subsections: 1. Lawfulness, Fairness and Transparency 2. Data minimisation and privacy by design 3. Storage limitation 14.1.1 Lawfulness, Fairness and Transparency As described throughout part A of this DPIA, in boxes with mitigating measures taken by STACKIT, STACKIT has agreed to only process personal data when necessary and proportionate for the instructions given by the customer. This includes limited further processing for 6 specific legitimate business purposes. As assessed in Section 11.2 this further processing is compatible with the purpose for which the Dutch government will instruct STACKIT to process data as processor. This ensures that government organisations can comply with their obligation to ensure the lawfulness of the data processing by STACKIT. 155 As described in Section 3.4 STACKIT has agreed to formalise its practice in the adapted DPA that it will never access Content Data for support purposes without prior consent from the customer (no standing access ).

Absent such an agreement, STACKIT would have operated as a third party controller for such access, and this would be unlawful. 154 See for example CJEU, C-131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, ECLI:EU:C:2014:317. Paragraph 71: In this connection, it should be noted that, subject to the exceptions permitted under Article 13 of Directive 95/46, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive (see Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 65; Joined Cases C ‑ 468/10 and C ‑ 469/10 ASNEF and FECEMD EU:C:2011:777, paragraph 26; and Case C ‑ 342/12 Worten EU:C:2013:355, paragraph 33). 155 The lawfulness of the processing of Content Data on the tested services is out of scope of this umbrella DPIA: this is the responsibility of the Dutch government customers.

applies Directive 95/46 Art. 13 → GDPR Art. 23, Directive 95/46 Art. 6 → GDPR Art. 5, Directive 95/46 Art. 7 → GDPR Art. 6

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 93 of 117 With regard to transparency, STACKIT has made more information available to SLM Rijk, but has yet to make this documentation public, relating to the factual data processing in security and webserver access logs. As described in Section 3.3.2 system administrators can view some of the system generated server logs as audit logs, but not the other service generated server logs, such as login-logs. Even though STACKIT provided access to Privacy Company upon request, the existence of these logs is not documented, and STACKIT only offers limited access via an API and, per 1 May 2026, via a Telemetry Router. Due to the lack of documentation, admins are not aware of the limited availability. STACKIT does not publish a central source of information about retention periods of the different personal data, but it has agreed with the Dutch government in the adapted DPA on maximum retention periods for the processor data, as documented in the box with mitigating measures in Section 10.

Finally, as described in Section 3.5 STACKIT has updated the documentation of the functional cookies it sets on both types of Websites. Privacy Company has not tested if the new documentation is complete. Customers can partially mitigate the risks of STACKIT's lack of publicly accessible documentation by pseudonymising the admin accounts. 14.1.2 Data minimisation and privacy by design The principles of data minimisation and privacy by default demand that the processing of personal data is limited to what is necessary: Data must be “ adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ” (article 5 (1) (c) GDPR). This means that government organisations may not collect and store data (or allow STACKIT to collect and store data) which are not directly related to a legitimate purpose. According to this principle, the default settings for the data collection should be set in such a way as to minimise data collection by using the most privacy friendly settings.

STACKIT is commendable for having taken this principle to heart, in 3 ways: for cookies, e-mail newsletters and Telemetry Data. Both its restricted access and publicly accessible relevant web pages, STACKIT only sets functional cookies. STACKIT has also improved the design of its cookie banner, to give the ‘reject’ button equal prominence as the ‘accept’ button. As described in Section 3.2 STACKIT also applies privacy by design to the creation and use of the admin Account Data. Admins only have to provide their e-mail address if they are not also billing contact, and STACKIT only used this address, both during and after testing to send functional mails. Finally, and different from all other cloud providers previously tested by SLM, STACKIT does not collect Telemetry Data from the browser. 14.1.3 Storage limitation The principle of storage limitation demands that personal data are only retained as long as necessary for the purpose in question.

Data must be “ kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ” (article 5 (1) (e), first sentence GDPR). This principle therefore demands that personal data are deleted as soon as they are DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 no longer necessary to achieve the purpose pursued by the controller. The text of this provision goes on to clarify that “ personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ” (article 5 (1) (e), second sentence, GDPR).

As described in Section 10 of this report, STACKIT publishes very few specific retention periods. However, STACKIT has agreed with the Dutch government in the adapted DPA on maximum retention periods for the processor data, as documented in the box with mitigating measures in Section 10. As a processor, STACKIT retains the Content Data as long as the customer doesn’t actively delete them, or ends the contract, plus a default fail-safe retention period of 30 days for data in the Cloud Storage. STACKIT retains logs for IT security purposes and other service generated server logs for 90 days, plus the audit logs for a period of 13 months, and the webserver access logs for a very short period of 7 days. These periods are in line with what customers expect, and are not excessive. STACKIT retains the support tickets, and the metadata for 24 months. This may be longer than Dutch government organisations can justify.

Generally, organisations need to motivate if they need to store tickets for longer than 13 months (enough to capture annually recurring incidents). To accommodate the concern about a possibly excessive retention period, STACKIT has committed to comply with deletion requests from customers, for a single ticket of for all tickets prior to a certain date. STACKIT will only exceptionally refuse such a request, if the ticket contains information about a commercial dispute, and STACKIT needs to retain the ticket for legal self defence. The impact on data subjects becomes higher if the retention period is longer. In view of the further specification and agreement in the adapted DPA that STACKIT only processes these personal data as a processor and authorised data controller, these retention periods are proportionate. In sum , even though STACKIT is highly commendable for applying privacy by default and not collecting Telemetry Data, absent adequate documentation about the personal data processing, including documentation about the (necessity for) maximum retention periods, the current processing is not proportionate.

Dutch government customers cannot assess if the processing does not go further than what is necessary. 14.2 Assessment of the subsidiarity The key question is whether the same goals can be reached with less intrusive means. STACKIT competes with global players with similar infrastructure and database offerings. Like its competitors, STACKIT offers a high-quality service at a reasonable cost, in terms of scalability, flexibility and reliability. There is no publicly available information that compares the compliance of all of these competing suppliers of cloud services with privacy laws and regulations. The Dutch government has negotiated or aims to negotiate GDPR-compliant contracts for the use of cloud services from Microsoft Azure, AWS, Google Cloud Platform, Oracle, Salesforce, SAP and IBM. These (future) contracts ensure that government organisations can choose between multiple cloud providers.

SLM Rijk publishes updates and DPIAs at https://www.rijksoverheid.nl/onderwerpen/zakendoen-met- het-rijk/strategisch-leveranciersmanagement-microsoft-rijk . DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 95 of 117 As a German provider, STACKIT has a unique advantage (like SAP) compared to its competitors from the USA. STACKIT cannot be subjected to US American law, including executive orders of the president. As described in Section 7.2, the Dutch government has an essential interest in data sovereignty, to better prevent loss of confidentiality and sudden unavailability. The new DPA with the Dutch government includes limitative lists of purposes for all five categories of personal data, limits potential disclosure of these data to public bodies and limits the engagement of subprocessors outside of the EU. Based on these terms and agreed processing limitations, STACKIT realises the inherent benefits of being German and independently owned.

As described in Section 4, it is possible for government organisations to pseudonymise admin account data, and apply some type of encryption to Content Data hosted on a VM. Organisations can also encrypt the entire VM with a database and storage, if they assess the Content Data are state secret. Privacy Company has not tested the available encryption measures. In sum , compared to competing providers, with which the Dutch government has already negotiated contracts, STACKIT can offer similar services with a higher level of privacy protection. 15. Rights of data subjects The GDPR grants data subjects the right to information, access, rectification and erasure, object to profiling, data portability and file a complaint. It is the data controller’s obligation to provide information and to duly and timely address these requests. If the data controller has engaged a data processor, the GDPR requires the data processing agreement to include that the data processor will assist the data controller in complying with data subject rights requests.

As discussed in Section 6.2 based on the adapted DPA with the Dutch government, STACKIT qualifies as data processor for the processing of the Content, Account, Diagnostic, Support and restricted access Website Data, with some exceptions when STACKIT is authorised to process some personal data for agreed legitimate business purposes. Both in a role as processor and as authorised controller STACKIT commits to assist the controller with any data subject access requests. 15.1 Right to information Data subjects have a right to information. This means that data controllers must provide people with easily accessible, comprehensible and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of data subjects. As quoted above in Section 13, the EDPB explains in its Guidelines on transparency that controllers should clearly explain the most important consequences of the processing.

“[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data. ” 156 156 The EDPB has adopted the Article 29 Working Party guidelines WP 260 rev 1, Guidelines on transparency under Regulation 2016/679, adopted on 29 November 2017, as last Revised and Adopted on 11 April 2018. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 One of the purposes of this umbrella DPIA is to help government organisations that wish to use the tested STACKIT services to better inform their employees about the agreed scope and purposes of the data processing. As assessed in Section 14.1.1, STACKIT has provided important clarifications to SLM Rijk, and has improved its public cookie documentation, but still needs to publish that information. The identified information omissions are: 1. Existence, contents and retention period of Security logs 2.

Existence, contents and retention period of the other service generated server logs, in particular the login-logs. 3. The personal data STACKIT collects in its webserver access logs for both types of visited Websites, and how long STACKIT retains the cookie-related personal data in these logs. Based on this DPIA and the adapted DPA government organisations that procure the tested services can inform their employees. However, for prospective customers it is difficult to fully understand what personal data STACKIT processes and for how long. In sum , Dutch government organisations can comply with their obligations to provide their employees with adequate information about the scope and purposes of the data processing, if they use this DPIA and the adapted DPA. 15.2 Right to access Data subjects have a (fundamental) right to access personal data concerning them. Upon request, data controllers must inform data subjects whether they are processing personal data about them (directly, or through a data processor).

If this is the case, they must provide data subjects with a copy of the personal data processed, together with information about the purposes of processing, recipients to whom the data have been transmitted, the retention period(s), and information on their further rights as data subjects, such as filing a complaint with the Data Protection Authority. STACKIT undertakes as a data processor to assist its customers with such requests. As assessed in Section 3.6 above STACKIT provided a general reply to the DSAR within 18 days that STACKIT was not the controller. STACKIT later agreed to provide access to two types of service generated server logs that it normally doesn’t provide to customers, the identity and access management logs, and authentication logs via IDP. STACKIT did not explicitly refuse access to any personal data, but did not provide any personal data regarding: 1. Security logs (STACKIT only provided very limited audit logs) 2.

Cookie-related personal data. 3. Webserver access logs for both types of visited Websites: the 3 relevant restricted access websites (admin console, login and support portal) and the 3 relevant publicly accessible STACKIT pages with technical and legal information. STACKIT did not argue that disclosing certain personal data would harm its company confidential objectives, such as its exact security posture. If this was the reason for the omission it should provide detailed reasoning. As the EDPB explains in its Guidelines on restrictions under Article 23: “ Any restriction shall respect the essence of the right that is being restricted. This means that restrictions that are extensive and intrusive to the extent that DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 97 of 117 they void a fundamental right of its basic content, cannot be justified. In any case, a general exclusion of data subjects' rights with regard to all or specific data processing operations or with regard to specific controllers would not respect the essence of the fundamental right to the protection of personal data, as enshrined in the Charter.

If the essence of the right is compromised, the restriction shall be considered unlawful, without the need to further assess whether it serves an objective of general interest or satisfies the necessity and proportionality criteria. ” 157 The Dutch implementation law implements the same exceptions as Art. 15(4) and Art. 23 of the GDPR, with the legal explanation that data controllers may only invoke these exceptions when it is strictly necessary, as foreseen in Art. 8 (2) of the ECHR and Art. 51 of the Charter of Fundamental Rights. 158 In reply to these observations STACKIT explained why it seldom has personal data in its security logs, and only stores the webserver access log for 7 days. STACKIT agreed to provide full access to all available personal data it processes as processor and as authorised controller, to the extent reasonably possible. In sum , STACKIT commits to fully comply with its obligations to provide access.

applies ECHR Art. 8(2)

Privacy Company has not filed a new DSAR to verify compliance, as this would have required retesting. 15.3 Right of rectification and erasure Thirdly, data subjects have the right to have inaccurate or outdated information corrected, incomplete information completed and - under certain circumstances - personal information deleted or the processing of personal data restricted. Customers can delete Content Data, and can access and change some of the Account and Support Data. However, as noted in Section 10 of this DPIA, in its standard DPA STACKIT applies a grace period of 30 days before deleting the Content Data. This period allows customers to either retrieve or delete the data. In the adapted DPA with the Dutch government, customers can immediately delete Content Data. Customers cannot influence the retention periods for three other categories of data: the Account Data, Diagnostic Data (audit logs, other service generated server logs, security logs), and Website Data.

As assessed in Section 14.1.3 above, these retention periods are proportionate. STACKIT has agreed in the adapted DPA to enable Dutch government organisations to delete support tickets, to overcome the standard long retention period of 24 months. In view of the new option for data controllers to instruct STACKIT as a processor to delete the Support personal data, STACKIT meets the requirements of Article 17(1)(a) and (d) of the GDPR. These provisions require a data controller to delete personal data without undue delay upon request of a data subject if they are no longer needed for the purposes for which they were collected or otherwise processed, or when the 157 EDPB. Adopted Guidelines 01/2022 on data subject rights - Right of access, Version 2.0, Adopted on 28 March 2023, par.14, URL: https://edpb.europa.eu/system/files/2023- 04/edpb guidelines 202201 data subject rights access v2 en.pdf 158 Memorie van toelichting bij de UAVG Art. 41: “ Gelet op het belang van de rechten van betrokkene, de meldplicht en de beginselen dienen verwerkingsverantwoordelijken alleen van de bevoegdheid om af te wijken gebruik te maken indien dit strikt noodzakelijk is en op proportionele wijze gebeurt.

Net als onder artikel 43 van de Wbp geldt voor de toepasselijkheid van deze gronden dus een strikt noodzakelijkheidscriterium (vergelijk artikel 8, tweede lid, van het EVRM en artikel 52, eerste lid, van het Handvest) . ” DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 personal data have been unlawfully processed (in case an admin accidentally attaches confidential data to a support ticket). In sum , based on the adapted DPA STACKIT allows government organisations to comply with their obligation to erase outdated or unlawfully processed data. 15.4 Right to object to profiling Fourthly, data subjects have the right to object to an exclusively automated decision if it has legal effects. The Dutch government has a specific contractual guarantee from STACKIT that it does not use the admin Account Data for profiling purposes. The only exception should be that an admin can provide valid consent for tracking cookies. 15.5 Right to data portability Employees have a right to data portability if the processing of their personal data is carried out by automated means and is based on their consent or on the necessity of a contract.

applies Wbp Art. 43, EVRM Art. 8(2)

As processor, some of the data processing by STACKIT on behalf of government organisations could be based on the necessity of performing a (employment) contract with the admin. STACKIT commits to comply with the right to data portability in the adapted DPA with the Dutch government. However, the exercise of the right to data portability is not realistically possible for admins: as they would copy confidential data and personal data from the government organisation. Hence, admins cannot use this right to demand export of confidential data and personal data from the government organisation (Article 20(4) of the GDPR). 15.6 Right to file a complaint Finally, government organisations as controllers must inform their employees about their right to complain, internally to their Data Protection Officer (DPO), and externally, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). This is out of scope of this umbrella DPIA.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 99 of 117 Part C. Discussion and Assessment of the Risks This part concerns the description and assessment of the risks for data subjects. This part starts with an overall identification of the risks to the rights and freedoms of data subjects as a result of the processing of the Content, Account, Diagnostic, Support and two types of Website Data. The risks will subsequently be classified according to the likelihood they might occur, and the impact on the rights and freedoms of the data subjects when they do. 16. Risks 16.1 Identification of risks Below, a general distinction is made between the risks of the processing of metadata (generated through use of the services) on the one hand, and the Content Data on the other hand. Based on the original terms and standard DPA, this DPIA identified 18 specific data protection risks, 15 of which applied to the Metadata and 7 to the Content Data. 5 risks overlapped, relating to a lack of transparency, lack of purpose specification, disclosure to public bodies, Feedback and the 9 purposes for which STACKIT can legitimately process as independent data controller.

The data protection risks can be grouped in the following categories:  inability to exercise rights (including but not limited to privacy rights)  inability to access services or opportunities  loss of control over the use of personal data  discrimination  identity theft or fraud  financial loss  reputational damage  physical harm  loss of confidentiality  re-identification of pseudonymised data or  any other significant economic or social disadvantage 159 These risks have to be assessed against the likelihood of the occurrence of these risks and the severity of the impact. The UK data protection commission ICO provides the following guidance: Harm does not have to be inevitable to qualify as a risk or a high risk. It must be more than remote, but any significant possibility of very serious harm may still be enough to qualify as a high risk. Equally, a high probability of widespread but more minor harm might still count as high risk. 160 In order to weigh the severity of the impact, and the likelihood of the harm for these generic risks, this report combines a list of specific risks with specific circumstances of the specific investigated data processing. 159 List provided by the ICO, step 5, URL: https://ico.org.uk/for-organisations/uk-gdpr- guidance-and-resources/accountability-and-governance/data-protection-impact-assessments- dpias/how-do-we-do-a-dpia/ 160 Idem, step 5.

DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 101 of 117 data about admin behaviour, and makes it too difficult for organisations to export these data for this risk to materialise. STACKIT only sent functional mail during and after testing. STACKIT commits to only send commercial newsletters with specific consent from admins and commercial contacts, thus preventing the risk of loss of time and annoyance because of unsolicited mail. STACKIT does however permit itself to present unsolicited surveys to admins after completion of a support ticket, in the form of Feedback Requests. In all, the observed processing of the Account, Diagnostic, Support and Website Data resulted in 12 high, and 3 low data protection risks. Based on the adapted new DPA with the Dutch government, many of these risks have been mitigated. 16.1.2 Content Data In its role as data processor for the Content Data (both in the standard DPA and in the new DPA with the Dutch government), STACKIT can process highly sensitive or confidential/secret content data from Dutch government organisations.

The standard DPA did not exclude standing access by STACKIT to the Content Data for support, maintenance and IT security purposes. The only remedy for Dutch government organisations was to use encryption for the data at rest. As explained in Section 4.1 these options were not tested. Similar to the risks described above for unauthorised access to the metadata, the Content Data can also unlawfully be accessed by a rogue system administrator or hostile state actor, and STACKIT can be compelled to disclose these data in reply to orders from public bodies in the EU (law enforcement, courts, secret services/security agencies). As described in Section 8.1.1, STACKIT permitted itself in its standard DPA to incidentally transfer Content Data outside of the EU, based on adequacy decisions from the European Commission (for example, to the USA), or to unspecified third countries, based on Standard Contractual Clauses.

Unauthorised disclosure of the contents of data hosted on an STACKIT VM, storage space or database, or the audit logs, could breach government and professional confidentiality and secrecy classifications. Based on the standard terms and DPA, the processing of Content Data in a STACKIT VM, object storage and Maria DB resulted in 5 high, and 2 low data protection risks , all but one overlapping with the risks for the four categories of Metadata. Based on the adapted new DPA with the Dutch government, many of these risks have been mitigated. 16.2 Assessment of risks 16.2.1 Loss of control purposes processing of admin data in Account, Diagnostic (minus audit logs), Support and Website Data (STACKIT controller) As described in Sections 5.2 and 5.3 based on the standard DPA STACKIT processed the Account, Diagnostic, (minus the audit logs), Support and both types of Website Data as a data controller.

As described in Section 8.1.2 STACKIT did not provide sufficient transparency about the contents of the Account Data, Diagnostic Data, the metadata collected through Support Requests and the two types of Website Data, or control over the purposes of the processing of these metadata. Based on the new DPA with the Dutch government, the agreed processing purposes are specific and legitimate. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 The probability of loss of control over the purposes of the processing of the Account, Diagnostic (minus the audit logs), Support and Website Data is quasi zero, even though the impact for data subjects could potentially be high. The Dutch government has the right to audit STACKIT’s compliance with the agreed purpose limitation. Therefore, the loss of control over the purposes of the processing has been mitigated/qualifies as a low risk. 16.2.2 Loss of control through transfer of Account, Diagnostic (minus the audit logs), Support and Website Data outside of the EU (STACKIT controller) Based on STACKITS public Data Protection Notice and standard DPA, STACKIT had to be qualified as data controller for the Account, Diagnostic (minus audit logs), Support and two types of Website Data.

As controller, STACKIT does not offer an EU data residency choice, nor control over the choice of subprocessors. STACKIT does not provide a list of processors in its Data Protection Notice, but even if STACKIT did, STACKIT could silently update and change this information, as happened during the writing of this DPIA. As described in Section 3.5 traffic was observed with the names of five third parties that could be processors of STACKIT or independent controllers. One of these parties, Cloudflare, performs worldwide processing as a Content Delivery Network. STACKIT confirmed that this data processing is out of scope of the new enrolment framework with the Dutch government, that STACKIT processes these cookie consent management data as controller. As controller, STACKIT relies on Standard Contractual Clauses (SCC) for transfers to third countries, but these are insufficient without a further Data Transfer Impact Assessment.

However, based on the adapted DPA with the Dutch government, STACKIT no longer acts as controller for any of the data processing that is directly related to the use of the tested services and non-optional. As processor and as authorised controller for the services in scope of this DPIA, STACKIT has committed not to transfer any personal data outside of the EU, not itself and not via subprocessors. This reduces the probability of loss of control over data transfer to near zero. Even if the impact on admins could be high, the loss of control over the use of subprocessors and potential data has been mitigated/qualifies as a low risk. 16.2.3 Loss of control and lack of transparency retention periods for (admin) Account Data, Diagnostic Data (minus audit logs), Support and Website Data (STACKIT controller) As described in Section 10.2, as data controller, STACKIT didn’t specify the retention periods of the Diagnostic (minus audit logs) Support and Website Data, or provided internally contradictive different retention periods (for the Account Data).

Some of these data could (legally) also be processed by third parties (not processors) (for example, in relation to the Website Data), with unknown self-determined retention periods. The impact on data subjects becomes higher if the retention period is longer. In view of the agreed proportionate retention periods for the different categories of personal data (see below for the Support Data), Dutch government organizations can demonstrate compliance with the principle of data minimisation. The probability of loss of control is near zero. Even if the impact on data subjects is potentially high, this loss of control over the retention periods has been mitigated/qualifies as a low risk. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 103 of 117 16.2.4 Lack of transparency for login-logs missing from audit logs (overlaps with Content Data) As described in Section 3.3.1 STACKIT provides limited audit logging.

STACKIT does register login activities in the separate iam_unredacted-access-logs , but does not inform admins about the availability of these logs. The lack of access is described as separate risk in Section 16.2.8. As discussed in Section 14.1.1 STACKIT does not yet publish information about the personal data that it may generate about the use of its services by system administrators (in system-generated server logs). This processing is not visible for admins as audit logs. A lack of transparency makes the data processing inherently disproportionate. STACKIT has given Privacy Company access to the logs, and these contain the necessary information, but STACKIT does not document the availability. If government organisations cannot fulfil their basic information security duties as required by article 32 GDPR and cannot monitor and act in case of unauthorised access, the impact on data subjects is potentially high.

Provided government organisations take the recommended measures to mitigate the probability (by using the Telemetry Router from 1 May 2026, and by asking STACKIT for access), this lack of transparency can be qualified as a low risk. 16.2.5 Loss of control through confusion about purposes Content Data and audit logs (STACKIT processor ) When Privacy Company signed up for the services, STACKIT’s order confirmation stated that the Data Protection Notice applied to the processing next to the standard DPA, in other words, the purposes for which STACKIT processes personal data as a controller. Even though STACKIT replied to this observation that its Data Protection Notice wasn’t binding, the pop-up was very confusing for customers. The standard DPA did not include limitative lists of purposes and did not formally cover all categories of personal data. This meant government organisations could not assess the scope and impact of the data processing.

Hence, they could not comply with their accountability and information obligations (art. 5, 13, 14 and 24 of the GDPR). STACKIT has agreed to no longer show the confusing reference to its Data Protection Notice. Based on the adapted DPA with the Dutch government, the probability of processing for unauthorised purposes is near zero. Even if the impact could be high, the loss of control over the Content Data and audit logs has been mitigated/qualifies as a low risk. 16.2.6 Loss of control through vague purposes Content Data and audit logs (STACKIT processor) As described in Section 5.2 and 6.2.1, and assessed in Section 0, STACKIT included two purposes of the processing in its standard DPA that were not specific enough. These two purposes were ‘anonymisation of usage data’, and ‘optimisation and development’ of the Content Data and audit logs. The terms ‘optimising’ and ‘developing’ have a very broad meaning.

They can relate to both ‘commercial optimisation and development’ and to ‘technical improvement’ and ‘development of new data protection features’. Without specification of the practical consequences Dutch government organisations could not determine if the processing was necessary and not simply what is useful for STACKIT. The concept of DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 necessity has an independent meaning in EU law, which must be interpreted in a way that fully reflects the objectives of data protection law. 162 The second purpose, of anonymising the Usage Data and processing of these data in anonymised form, also was not specific enough, and probably incorrect. In reality, it was much more likely that STACKIT removes directly identifiable data, and aggregates data. STACKIT agreed and acknowledged such pseudonymisation efforts rarely lead to effective anonymisation, especially since STACKIT continues to collect identifiable data as longs as the customer has the contract with STACKIT.

In the adapted DPA with the Dutch government, STACKIT is authorised to create aggregated data, and use these data for specific legitimate business purposes, such as billing, creation of internal infrastructure forecast reports or financial reports. In view of the new agreement with the Dutch government with the limitative list of authorised further processing purposes, and a clear agreement on the level of aggregation of pseudonymised data, Dutch government organisations can prove they comply with the purpose limitation principle. The probability of unauthorised further processing by STACKIT (as a de facto controller) is highly unlikely, while the impact of such processing varies from medium to high. Therefore the loss of control over the processing for these two purposes of the Content Data and audit logs is mitigated/qualifies as a low risk. 16.2.7 Loss of control through standing access to Content Data (STACKIT processor and controller) As described in Section 3.4 based on its standard DPA, STACKIT as processor granted itself standing access to the Content Data for support and maintenance purposes, without consent from the customer.

As a controller, STACKIT lists the IT Security purposes in its Data Protection Notice, and does not distinguish between processing in its own plane, and in the customers plane (the tenant). It follows from the IT security purposes that STACKIT also permitted itself to access the Content Data without prior consent from the customer to solve security incidents. The only remedy for Dutch government organisations was to use encryption for the data at rest. As explained in Section 4.1 these options were not tested. The outcome of the proportionality assessment in Section 14.1.1 was that such standing access could lead to a data breach as long as STACKIT operated as a third party for this processing purpose. STACKIT has agreed to formalise its practice that it only accesses Content Data after prior authorisation of the customer, both in a role as processor and a role as authorised controller. Based on that commitment the probability of access by engineers seems highly unlikely.

Even if the impact of unauthorised access could be very high, the risk of loss of control through standing access to the Content Data has been mitigated. 162 Idem, footnote 16: The CJEU stated in Huber that “what is at issue is a concept [necessity] which has its own independent meaning in Community law and which must be interpreted in a manner which fully reflects the objective of that Directive, [Directive 95/46], as laid down in Article 1(1) thereof”. CJEU, Case C ‑ 524/06, Heinz Huber v Bundesrepublik Deutschland, 18 December 2008, para. 52 . DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 105 of 117 16.2.8 Inability to exercise data subject right to access Diagnostic (minus audit logs), Support metadata and Website Data (STACKIT controller) Based on the standard DPA, STACKIT only qualified as a processor for the audit logs, but not for the other service generated server logs, the security logs, or the webserver access logs.

As described in Section 3.6 and analysed in Section 15.2 STACKIT did not provide access to the security logs and the Webserver access logs in its self-qualified role as controller, and only provided access to the two other types of service generated server logs (Identity and access management logs, and Authentication logs via IDP) as a matter of courtesy, not as a regular reply to DSARs. Access to such logs is necessary for customers to detect and mitigate security risks relating to logins by their own admins. As described in Section 3.3.4 STACKIT has explained the contents of its security logs. Though it is theoretically possible that STACKIT captures IP-addresses from website visitors in its security logs, if a government organisation hosts a website on a STACKIT VM, the probability is very low, in view of the sampling of the data and the practice to not store the source IP addresses, except in flagged security incidents.

Based on this new information government organisations can exclude the possibility that STACKIT incorrectly refuses access to these data. STACKIT also did not provide access to any Website Data, or to any Support metadata that it could have registered in its support ticketing system. However, in the adapted DPA STACKIT commits to provide access to all available personal data, when reasonably possible. If STACKIT is a controller, for the public Website Data, it will also provide access to Cookie Data, provided STACKIT can reliably identify the data subject. Based on the new agreement, the probability of occurrence of incomplete access to the personal data is remote. Privacy Company has not retested. Therefore the risk is not fully mitigated. The impact of an access limitation is high, because access to personal data is a fundamental right. Data subject access is a building block of the GDPR as starting point for data subjects to exercise their other rights.

Even if the impact is high, the risk of the inability to exercise the right to access these data can be qualified as low. 16.2.9 Inability to exercise data subject right to delete Support Data (STACKIT controller) As described in Section 3.4 and assessed in Section 15.3 STACKIT initially did not allow customers to delete all or individual support tickets. STACKIT allows admins to upload attachments in a support conversation, but did not warn them not to upload personal or confidential data. STACKIT also does not offer a personal data masking tool in this support dialogue, which would help admins block out certain parts of a screenshot before uploading. In reply to this DPIA, STACKIT has committed in the adapted DPA with the Dutch government that customers can request deletion of all or individual support tickets and attachments. STACKIT will only refuse such a request in rare circumstances, if the ticket is necessary for billing or legal self-defence.

The probability that admins cannot delete a support ticket has become remote. The impact of excessive data retention of potentially sensitive data can be high. However, provided Dutch government organisations take the recommended measures, the risk of the inability to delete support tickets can be qualified as low. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 16.2.10 Loss of control due to lack of login information to admin accounts in audit logs (STACKIT processor) As described in Section 3.3.1 STACKIT provides limited audit logging. This makes it difficult to know which data were involved in case of a data breach, and limits options for recovery and notification. STACKIT does register login activities in the separate iam_unredacted-access-logs , but does not provide the contents to admins, not separately, and not as part of the audit logs. STACKIT only provided these logs as courtesy for this DPIA.

Absent these logs, government organisations cannot monitor unauthorised access to admin accounts. The absence of detailed log-in logs means that compromised admin accounts could still cause unlogged access to Content Data. 163 The compromised admin account can create access credentials that can access Content Data in the buckets, VM and MariaDB without leaving traces in the application logging. As explained in Section 3.3.2 STACKIT has committed to make more audit logs available via its Telemetry Router per 1 May 2026, and hopes to offer full access to the unredacted IAM logs as part of the audit logs per June 2027. To mitigate the risks during this long period admins are advised to take the following mitigating measures:  Until additional iam-logging is available via the admin-portal, ask for additional logs on a regular basis by means of a support ticket.  Until STACKIT makes more extensive access logging available for the database and object storage services, assess whether personal data in these services are accessible to individuals other than a limited group of administrators.

If so, take additional logging measures, for example by making the service available only via a proxy that implements the necessary access logging. This is likely primarily relevant for applications where object storage buckets are accessed directly through users' web browsers. Provided the government admins implement these recommended measures, the probability of the loss of control due to lack of login information is remote. Even though the impact on data subjects whose data may be part of Content Data can be very high, the risk of the loss of control due to lack of login information can be qualified as low. 16.2.11 Loss of control disclosure 5 categories of data to public bodies outside of the EU As described in Sections 2.3, 5.3.2 and Fout! Verwijzingsbron niet gevonden. even though STACKIT as a German company under exclusive German ownership is not subjected to foreign law or jurisdiction, STACKIT may be ordered by government authorities, agencies or courts in the EU, or parties that can invoke EU law, to disclose personal data from customers.

Such disclosures by processors are explicitly authorised by Art. 29 GDPR. Based on the adapted DPA with the Dutch government, STACKIT will exclusively process all personal data within the EU, including by subprocessors. Additionally, 163 Even if government organisations apply the recommended mitigating measure to ensure adequate logging of access to the Content Data via their own applications (see low risk no. 1 below), see Section 16.2.15. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 107 of 117 STACKIT commits to unconditionally reject any request for disclosure from a non-EU authority. Even though the impact of compelled disclosure to non-EU authorities could be very high, based on the contract with the Dutch government, including the right to audit compliance with the instructions, the probability of occurrence is near zero. Therefore the risk of loss of control through compelled disclosure to public bodies outside of the EU can be qualified as low. 16.2.12 Loss of control due to EU Sanction list As described in Section 5.3.2 STACKIT describes in its Data Protection Notice that it may be forced to refuse customers if their names appear on an EU Sanction list.

Because STACKIT did not distinguish contractually between Commercial Contact Data and admin Account Data in its standard terms, it was unclear to what data STACKIT referred. If STACKIT would proactively compare admin Account Data with such a blocklist, the impact could be very high if there was no right to correct a potential mistake for the admin In reply to this DPIA STACKIT has clarified it will never process admin Account Data for this purpose, only institutional contact data. Based on the agreement between the Dutch government and STACKIT about this procedure, the probability of a loss of control is remote. The impact of contract termination or refusal for an organisation is hard to estimate, but the risk of loss of control due to appearance on an EU Sanction list can be qualified as low. 16.2.13 Loss of control processing Account and Content Data in Feedback STACKIT qualifies itself as independent controller for the collection of Feedback Data.

Employees are generally not authorised or mandated to share data from and about working with STACKIT with a third party controller (STACKIT in this case). STACKIT relies on consent when it sends admins a satisfaction survey upon closing of a support ticket, but employees should not be concerned that, as part of their work, they can provide consent that could lead to unlawful processing (data breach). The impact of unauthorised disclosure of Content Data to STACKIT can be high. STACKIT may receive personal data via Feedback that might be sensitive in nature, or even special categories of data, if STACKIT allows employees to write comments in an open text box or send screenshots of dialogues, for example. STACKIT does not offer an option to government organisations to centrally prevent STACKIT from asking for Feedback. The only mitigating measure government organisations can take is organisational, to warn admins not to provide Feedback.

This can lower the probability to low, in view of the fact that each organisation only has a few admins, and they are generally trained in data hygiene (different from average end users). Provided government organisations implement this measure in an effective way, the loss of control over Feedback Data can be qualified as a low risk. 16.2.14 Loss of control through absence of cookie documentation As described in Sections 3.5.1 and 3.5.2, and analysed in Sections 9 and Fout! Verwijzingsbron niet gevonden. STACKIT only sets functional cookies by default. However, STACKIT initially did not provide the legally required information about the functional cookies it sets and reads on the 3 relevant restricted access Websites, and the 3 relevant publicly accessible pages. Admins and other employees such as privacy DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 officers cannot prevent visiting these websites, and receiving these cookies.

STACKIT’s remedy to stop using the sites would make the services unusable. STACKIT does not inform the admins that it can read cookies set in the admin browser on the restricted access login portal when that admin later visits the publicly accessible Knowledge Base. Additionally, during testing, traffic and cookies were observed mentioning names of other parties, namely Atlassian, Atlassian's partner MiniOrange 164 and Cloudflare (via OneTrust). None of this traffic was documented. In reply to these observations STACKIT agreed to apply privacy by default in the adapted DPA, both to the restricted and to the publicly accessible websites. STACKIT has already improved the available cookie documentation. STACKIT also explained it did not share personal data with these third parties, with the exception of Cloudflare, via OneTrust, but only in a role as controller for the publicly accessible webpages.

Based on STACKIT’s observed cookie practice and improved documentation, the probability of absence of cookie documentation is low, while the impact may vary from some to severe, if IP-addresses from admins would be shared with third parties. Therefore this risk of loss of control through the absence of cookie documentation can be qualified as low. 16.2.15 Loss of control lack of logs access to Content Data As described Section 3.3.1 STACKIT’s audit logs do show if a signed-in admin has performed a major task, like creating or deleting an instance, but do not show if admins have accessed databases or contents of storage buckets, or any other access to Content Data inside the services. It is common practice amongst cloud providers to provide an option to organisations to download logs with details about access to the Content Data in storage buckets (not for VMs or databases). This is especially relevant if the buckets contain contents that are made publicly available via the Internet.

Government organisations are responsible to ensure adequate logging via the systems or applications they use to access the VM, buckets and MariaDB, through other means than via STACKIT. Provided government organisations implement the recommended additional measures until STACKIT provides easy access to these logs (which is expected to be the case until June 2027), the probability of occurrence is low. If an organisation cannot detect or mitigate unauthorised access to Content Data, the impact on data subjects whose personal data are part of the Content Data can be severe. Because the probability is low, and STACKIT has committed to a structural solution, even though the potential impact is high, the risk of loss of control due to missing logs about access to the Content Data can be qualified as low. 16.2.16 Loss of control processing 9 purposes STACKIT independent controller Even though the Dutch government and STACKIT have agreed on a new enrolment framework with processor purposes and authorised further processing purposes, STACKIT still remains an independent data controller for 9 relevant controller purposes of the processing, as listed in Section 6.3.

If admins consent to tracking cookies, or voluntarily communicate with STACKIT via social media, it is possible that their identity becomes known to third parties. Government organisations can prevent such data leakage with organisational measures, such as warning admins not to consent to tracking cookies, and by using pseudonymous admin data for participation 164 MiniOrange, MiniOrange Security Software, undated, URL: https://www.miniorange.com (last visited 23 May 2025). DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 109 of 117 in public discussions. Such measures can lower the probability to remote. Even if the impact on admins could be high if their identity leaked, for example if they became targets for spear phishing, the risk of the loss of control over the processing for these 9 purposes is nevertheless qualified as low. 16.2.17 Loss of control through insufficient security documentation As described in Section 7.1, STACKIT organises independent audits on ISO 27001, ISO 20000, ISO 50001 and C5.

STACKIT did not yet provide a copy of the C5 audit to Privacy Company (the test customer). Initially, STACKIT contractually only offered to provide a letter of attestation or certification with the outcomes of these audits, but not the full report. This has been solved in the adapted DPA with the Dutch government. As data controllers, Dutch government organisations must be able to prove their compliance with article 32 of the GDPR, to take adequate technical and organisational measures to protect the personal data against security breaches. The access to the full contents of audit reports ensures Dutch government organisations can complete their own DPIA. In the adapted DPA STACKIT also documents the names, purposes and locations of its subprocessors. STACKIT publishes an extensive document with Technical and Organisational Measures to secure its own business. In this document STACKIT only dedicates one sentence to pen-testing.

STACKIT describes it will subject new systems to such tests. 165 STACKIT does not describe if it also performs such pen-tests on systems of parties it engages down the processing chain. STACKIT does not explain if it performs new pen-tests in case of significant system changes, or if it periodically tests for the presence of recently discovered vulnerabilities. However, STACKIT also doesn’t exclude such security measures. Therefore, based on this single sentence, the probability of the loss of control through insufficient security measures is unknown. The impact on data subjects of possible security breaches can be very high, but absent insights in STACKIT’s practical application of its theoretical/legal information security policy, and pending access to the C5 audit report, the risk of loss of control through insufficient security measures is classified as low. 16.2.18 Loss of control tracking pixel in newsletter As described in Section 3.2.2 STACKIT initially offered an option to subscribe to newsletters.

STACKIT describes in its Data Protection Notice it uses tracking pixels and beacons in newsletters, that enable STACKIT to observe individual reading, forwarding and interaction behaviour such as clicking on a hyperlink. The use of such a tracking pixel requires prior, informed consent. However, STACKIT has since removed the option to subscribe to the newsletter. If STACKIT revives the newsletter, there is a high probability that the newsletter still contains tracking pixels. The impact of secret observation of reading behaviour is high, as it infringes on the constitutional right to communications secrecy. Absent subscription option, the probability of occurrence of secretive monitoring of reading behaviour is remote. Therefore the risk of the loss of control through the use of a tracking pixel currently can be qualified as low. 165 STACKIT writes: “ Neue Systeme werden im Rahmen der Abnahmeprüfung einer Sicherheitsprüfung unterzogen. ” DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Commit to only process the security logs with personal data relating to customers as a processor, and agree to authorised further processing of aggregated data.

Agreed in adapted DPA Publish more detailed and up-to-date documentation, including essential information such as the processing of IP addresses of visitors to STACKIT hosted websites/applications . STACKIT has provided SLM Rijk with additional information on this point, but STACKIT has not yet published this information. Commit to maintain the default settings on both types of web pages (no analytics or marketing cookies). Agreed in adapted DPA. STACKIT is a processor for the restricted access websites. Analytics and marketing cookies are only placed on public websites after voluntary consent of the user. (SLM Rijk): conduct audits on compliance with purpose limitation, data minimisation and retention periods Continue to organise C5 audits to demonstrate compliance with purpose limitation, data minimisation and retention periods. Disclose the full report to SLM, not just a letter of attestation or certification .

Agreed to extensive audit possibilities for SLM in adapted DPA. 2. Loss of control through transfer of Account, Diagnostic (minus audit logs), Support and Website Data outside of the EU (STACKIT controller) Offer an EU data residency choice for the Account, Diagnostic (minus audit logs), Support and the two types of Website Data. STACKIT as a processor only processes data in the EEA as agreed in adapted DPA. Become a data processor for the 5 identified strictly functional processing purposes, accept a limitative list of authorised further processing purposes. Accepted limitative lists of processor and authorised further processing purposes in adapted DPA. 3. Loss of control through lack of transparency retention periods Account, Diagnostic (minus audit logs), Support Pseudonymise admin employee accounts, for example using identity federation. Determine and publish defined retention periods for these four categories of data, including for the subcategories of service generated server logs and security logs.

Committed as processor to specific retention periods in adapted DPA. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Page 113 of 117 and Website Data (STACKIT controller) Become a data processor for the 5 identified strictly functional processing purposes, accept a limitative list of authorised further processing purposes. Accepted limitative lists of processor and authorised further processing purposes in adapted DPA. (SLM Rijk): conduct audits on compliance with purpose limitation, data minimisation and retention periods Continue to organise C5 audits to demonstrate compliance with purpose limitation, data minimisation and retention periods. Agreed to extensive audit possibilities for SLM in adapted DPA. 4. Lack of transparency about (inaccessible) login-logs Pseudonymise admin employee accounts, for example using identity federation. Make the iam_unredacted- access-logs available by default to admins, preferably as part of the audit logs.

Expected June 2027 5. Loss of control and lack of transparency purposes Content Data and audit logs (STACKIT processor) Remove the text in the order confirmation that the Data Protection Notice applies to the processing. STACKIT has agreed to remove the text. Include a procedure in the new agreement with the Dutch government how to deal with changes in the processing. Agreed in adapted DPA, both with regard to new subprocessors and to other changes. 6. Loss of control through unspecific and vague purposes Content Data and audit logs (STACKIT processor) Agree to delete the purposes optimisation and development, and anonymisation, from the agreed processor purposes. Accepted limitative lists of processor and authorised further processing purposes in adapted DPA. 7. Loss of control through standing access to Content Data (STACKIT processor) Allow Dutch government admins to disable standing access, and always ask for specific consent to access Content Data.

Agreed in adapted DPA to only access Content Data after individual authorisation by the customer. 8. Inability to exercise data subject access rights to Diagnostic (minus audit logs), support metadata, and Website Data (STACKIT processor) Provide meaningful access to all Diagnostic Data (including security logs), Support metadata, and Website Data (including webserver access logs) Commitment in adapted DPA to provide access when reasonably possible. NOTE: Privacy Company has not retested this with a new DSAR. 9. Inability to exercise data subject rights to delete Instruct admins to only share strictly necessary personal data in support Provide an option to delete all or individual support tickets or develop a According to adapted DPA STACKIT will generally honour DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Support Data (STACKIT processor) tickets. Do not use support tickets to file legal or financial claims. central option to prevent sharing of screenshots and attachments. requests to delete one or more support tickets and/or attachments, except if the ticket contains a complaint that STACKIT needs to retain for specific legitimate business operations.

Show a warning not to upload personal or confidential data Agreed to show the warning from December 2026. Instruct admins to annually ask STACKIT for deletion of all support tickets after the self determined retention period of for example 13 or 15 months. Offer a tool to mask specific data in a screenshot. Agree to only process aggregated data higher than tenant level from support tickets as authorised further processing purpose. Agreed in adapted DPA 10. Loss of control due to lack of login information in audit logs (STACKIT processor) Ensure adequate logging in applications that access Content Data on VMs, Object Storage buckets and MariaDB. Make the iam_unredacted- access-logs available by default to admins, preferably as part of the audit logs. Expected June 2027. Until additional iam- logging is available via the admin- portal, ask for additional logs on a regular basis by means of a support ticket.

Until STACKIT makes more extensive access logging available for the database and object storage services, assess whether personal data in these services is accessible to individuals other than a limited group of administrators. If so, take additional logging measures, for example by making the service available only via a proxy that implements the necessary access logging. This is likely primarily relevant for Create an easier export option for admins of the audit logs. STACKIT has published and documented an API to retrieve audit logs. This functionality will be replaced by the Telemetry Router from 1 May 2026 onwards. DPIA on STACKIT Cloud Platform public version 1.3 22 April 2026 Until STACKIT makes more extensive access logging available for the database and object storage services, assess whether personal data in these services are accessible to individuals other than a limited group of administrators.

If so, take additional logging measures, for example by making the service available only via a proxy that implements the necessary access logging. This is likely primarily relevant for applications where object storage buckets are accessed directly through users' web browsers. 16. Loss of control processing 9 purposes STACKIT independent controller Warn admins not to use their Admin Account Data to enable processing by STACKIT or third parties as independent controller, for example by consenting to tracking cookies. Accepted limitative lists of processor and authorised further processing purposes in adapted DPA. Agree to become an authorised controller for the relevant public Website pages. Based on adapted DPA, STACKIT performs the processing of personal data to provide public websites, including for ensuring data and IT security on such websites, as a controller. including for ensuring data and IT security on such websites, as a controller.

Commit to maintain the default settings on the relevant publicly accessible web pages (no analytics or marketing cookies). Agreed in adapted DPA. Analytics and marketing cookies are only placed on public websites after voluntary consent of the user. 17. Loss of control through insufficient security When available, study STACKIT’s C5 audit report and results of pen-tests. Document the names or involvement of processors and third parties that can access the four