Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a basic simple question for which I couldn't find anywhere.

Is is possible to use Google Cloud SQL services and still retain the regulations from ICO and other similar requirements?

I will not be storing any credit card or bank account information, will only store the PayPal (as current confirmed payment processing method) email and/or 'MerchantID'. The concerns are addressed only towards information regarding the registered individuals like: names, addresses, National Insurance Numbers and UTRs(which are for UK but their world wide equivalents will be stored as well) and general business information.

share|improve this question
up vote 3 down vote accepted

This document may help you:

I've only skimmed it, and a while ago, but I remember an important principle was having contractual agreements in place with your cloud provider.

share|improve this answer
Could you evaluate a little bit more about what should the 'contractual agreements' be? (I understand if you do not remember and would not recall on the statement, but it is easier for me to get it digested, as from time to time I do get very confused when it gets to legal stuff :) ) – DaGhostman Dimitrov Oct 23 '13 at 21:34
The Data Protection Act puts certain responsibilities on the Data Controller. If the Data Controller outsources something then the outsourcing contract must cover these responsibilities. – paj28 Oct 24 '13 at 8:18

(inital note, I'm not a lawyer and if you want proper legal advice you should get the proper opinion of a lawyer :)

Generally if you're storing data for EU citizens then the hosting location needs to either be in the EU or a country which is held to have equivalent data protection protections.

In addition it can be stored with a company with a "safe harbour" agreement, which google undoubtedly has.

This doesn't in any way remove requirements for you to store and process the data in compliance with the legislation but at the moment using Googles services doesn't automatically preclude compliance.

One note is that there are moves to tighten up this requirement in the EU at the moment, so this status may change..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.