Cloud computing and GDPR: legal and technical implications of the new regulation on SaaS in the portuguese context

Abstract

GDPR came into force, in order to reduce legal fragmentation, provide greater legal certainty, improve the protection of individuals, and contribute to the free flow of personal data within the Union but some uncertainties have arrived with it. The neutrality towards technology and the further data protection law developments, such as the Portuguese one, may create some grey areas that need further reflection. Law needs to take into consideration some sources that it traditionally didn’t, and it must acknowledge its dependence on cooperation with private experts to address inherent problems that come with the massive development in technology. Private standards are becoming increasingly important for the law and adopting them requires new procedural rules. Data protection developments seem to be not as fast as the technological ones and cloud computing is just one example. Cloud computing can be considered a new paradigm that is rapidly changing the landscape of information technology and consequently, various business models have evolved to integrate this technology into software applications, programming platforms, data storage, computing infrastructures and hardware as a service. Once again., private experts were quicker than the legislator and addressed first the privacy issues on the cloud computing context. This study aims to compare the already developed standards and the GDPR, in order to understand if compliance with the standards could be translated into compliance with the GDPR as well. If so, the Portuguese context will also be taken into consideration. This study is focused on SaaS structures, more precisely from the processor’s perspective, which, in this particular case, is the SaaS provider/developer.