2

I have a basic simple question for which I couldn't find anywhere.

Is is possible to use Google Cloud SQL services and still retain the regulations from ICO and other similar requirements?

I will not be storing any credit card or bank account information, will only store the PayPal (as current confirmed payment processing method) email and/or 'MerchantID'. The concerns are addressed only towards information regarding the registered individuals like: names, addresses, National Insurance Numbers and UTRs(which are for UK but their world wide equivalents will be stored as well) and general business information.

Improve this question

2 Answers 2

Reset to default
3

This document may help you: http://www.ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protection/Practical_application/cloud_computing_guidance_for_organisations.ashx

I've only skimmed it, and a while ago, but I remember an important principle was having contractual agreements in place with your cloud provider.

Improve this answer
2
  • Could you evaluate a little bit more about what should the 'contractual agreements' be? (I understand if you do not remember and would not recall on the statement, but it is easier for me to get it digested, as from time to time I do get very confused when it gets to legal stuff :) )
    – DaGhostman Dimitrov
    Commented Oct 23, 2013 at 21:34
  • The Data Protection Act puts certain responsibilities on the Data Controller. If the Data Controller outsources something then the outsourcing contract must cover these responsibilities.
    – paj28
    Commented Oct 24, 2013 at 8:18
2

(inital note, I'm not a lawyer and if you want proper legal advice you should get the proper opinion of a lawyer :)

Generally if you're storing data for EU citizens then the hosting location needs to either be in the EU or a country which is held to have equivalent data protection protections.

In addition it can be stored with a company with a "safe harbour" agreement, which google undoubtedly has.

This doesn't in any way remove requirements for you to store and process the data in compliance with the legislation but at the moment using Googles services doesn't automatically preclude compliance.

One note is that there are moves to tighten up this requirement in the EU at the moment, so this status may change..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .