It is 2016 and many businesses are making the switch to the cloud. Typically businesses use cloud-based service providers to store and access large amounts of proprietary data. Using cloud-based services offers many benefits, including a decreased upfront cost for implementing an effective IT infrastructure and an increased ability to easily collaborate on projects by allowing broad access to data. However, retaining a cloud-based service provider without an understanding of the key concepts can lead to costly legal disputes. When considering use of cloud-based services, be mindful of the following issues:
- Open Industry-Based Standards — A provider of cloud-based services should use open, industry-based standards for cloud computing. Even though the process of transferring data to the cloud is simple, if the provider uses proprietary standards, tools or protocols, it may be difficult and costly to switch providers. This is especially relevant where a contractual dispute arises and a company is unable to transfer or even access its data outside of locations controlled by the provider.
- User Owns the Data — It may seem obvious, but a company storing data “in the cloud” must ensure that those rights are undisturbed by their contract with the service provider, and that they retain all rights to the data once the data is stored. A user must also verify that the provider cannot access data for its own commercial benefit.
- Backup & Data Retention Policy — Users should verify their provider’s backup and data retention policies to ensure viability. All data should be backed up frequently and stored in multiple physical locations. If a user’s data and the backup are found on the same server chain, any issue with that chain will affect both the “original” data and the backup.
- Data Loss & Leakage Policy — In an environment where multiple users share common storage space on a remote server, there is the possibility that a user’s data could be inadvertently given to another user. Also, because the user is not in control of its data, any loss of data that occurs should be the fault of the service provider.
- Third-Party Access to Data — Users should consider how third parties may obtain access to data stored on the cloud. For instance, what is the provider’s policy for responding to subpoenas or civil discovery requests? What will happen to their data, as well as the terms of any contract with a service provider, if that provider is purchased by another company or files for bankruptcy?
Cloud-computing is a terrific development in managing your company’s data, but it is not without a host of new risks and legal issues.