Cloud Computing

Legal Framework

Cloud computing services are governed by an overlapping set of EU instruments. Under NIS2, cloud computing service providers are classified as essential or important entities subject to cybersecurity risk-management and incident-reporting obligations. Recital 33 defines the scope:

"Cloud computing services should cover digital services that enable on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources"
— NIS2 Recital 33

This definition explicitly encompasses IaaS, PaaS, SaaS, and NaaS, across private, community, public, and hybrid deployment models, aligning with ISO/IEC 17788:2014. Recital 84 confirms that cloud computing service providers are subject to "a high degree of harmonisation at Union level," with implementing acts facilitating cybersecurity risk-management measures. Non-EU providers offering services within the Union must designate an EU representative under Recital 116. Article 23 imposes incident notification duties on essential and important entities, requiring notification to the relevant CSIRT without undue delay.

On the data protection side, the GDPR applies to cloud providers acting as processors or controllers. The EDPB's Opinion 17/2021 recognises that the CISPE Code of Conduct aims to contribute to proper GDPR application "taking into account the specific features of the cloud computing sector."

Key Developments

The General Court in Amazon EU Sàrl v European Commission drew a clear boundary between cloud computing services and online platforms under the Digital Services Act (Regulation 2022/2065). The court upheld that marketplaces cannot be equated with cloud services for systemic-risk purposes:

"cloud computing or web-hosting services should not be considered to be an online platform where dissemination of specific information to the public constitutes a minor and ancillary feature or a minor functionality of such services"
— Amazon EU Sàrl v European Commission ¶140

This distinction matters because it determines which regulatory regime applies: cloud providers fall under NIS2 and GDPR obligations rather than the DSA's platform-specific transparency and risk-mitigation duties.

The EDPB has further clarified the functional differences between service models. For SaaS specifically:

"users are ultimately meant to outsource their data to the individual provider"
— EDPB Opinion 17/2021 §6

This characterisation directly informs the processor-controller analysis under Article 28 GDPR, as the degree of data control varies significantly between IaaS, PaaS, and SaaS arrangements.

Status of the Debate

This topic is actively contested in court. The boundaries between regulatory regimes — NIS2, GDPR, and the DSA — remain in flux, as evidenced by the Amazon litigation challenging whether marketplace services should be treated analogously to cloud computing. No definitive court split has crystallised yet, but the question of when a cloud service crosses into platform regulation under the DSA, and how processor-controller roles are allocated across different cloud service models, would benefit from further CJEU guidance. The EDPB's endorsement of sector-specific codes of conduct (CISPE and Scope Europe) signals a regulator-driven approach to standardising compliance, but these codes do not bind absent formal adoption by supervisory authorities.

Practical Guidance

• Classify your service model precisely. Determine whether you provide IaaS, PaaS, SaaS, or NaaS under the Recital 33 definition, as this classification drives both NIS2 obligations and the GDPR processor-controller analysis under Article 28.
• Map NIS2 incident-reporting triggers. Establish internal thresholds for what constitutes a "significant incident" under Article 23 and build notification workflows to the relevant CSIRT, including cross-border escalation procedures.
• Designate an EU representative if established outside the Union. Under Recital 116, non-EU cloud providers offering services to persons in Member States must appoint a representative — mere website accessibility is insufficient, but use of EU languages or currencies triggers the obligation.
• Clarify processor vs. controller status contractually. For SaaS models where users outsource data to the provider, ensure Article 28 data processing agreements reflect the actual allocation of data-control responsibilities, particularly for sub-processor chains.
• Consider adherence to an approved code of conduct. EDPB-endorsed codes such as CISPE provide a practical compliance benchmark aligned with sector-specific cloud characteristics, supporting accountability under Article 24 GDPR.