I have a basic simple question for which I couldn't find anywhere.

Is is possible to use Google Cloud SQL services and still retain the regulations from ICO and other similar requirements?

I will not be storing any credit card or bank account information, will only store the PayPal (as current confirmed payment processing method) email and/or 'MerchantID'. The concerns are addressed only towards information regarding the registered individuals like: names, addresses, National Insurance Numbers and UTRs(which are for UK but their world wide equivalents will be stored as well) and general business information.


This document may help you: http://www.ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protection/Practical_application/cloud_computing_guidance_for_organisations.ashx

I've only skimmed it, and a while ago, but I remember an important principle was having contractual agreements in place with your cloud provider.

  • Could you evaluate a little bit more about what should the 'contractual agreements' be? (I understand if you do not remember and would not recall on the statement, but it is easier for me to get it digested, as from time to time I do get very confused when it gets to legal stuff :) ) – DaGhostman Dimitrov Oct 23 '13 at 21:34
  • The Data Protection Act puts certain responsibilities on the Data Controller. If the Data Controller outsources something then the outsourcing contract must cover these responsibilities. – paj28 Oct 24 '13 at 8:18

(inital note, I'm not a lawyer and if you want proper legal advice you should get the proper opinion of a lawyer :)

Generally if you're storing data for EU citizens then the hosting location needs to either be in the EU or a country which is held to have equivalent data protection protections.

In addition it can be stored with a company with a "safe harbour" agreement, which google undoubtedly has.

This doesn't in any way remove requirements for you to store and process the data in compliance with the legislation but at the moment using Googles services doesn't automatically preclude compliance.

One note is that there are moves to tighten up this requirement in the EU at the moment, so this status may change..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.