Purpose
Anyone who uses a cloud service regularly has personal data processed by the provider and remains responsible as the controller. This skill examines the three critical axes of data protection-compliant cloud use: the data processing agreement (Art. 28 GDPR), the security of processing (Art. 32 GDPR) and the permissibility of data transfers to third countries (Art. 44 GDPR et seq., Chapter V). It uncovers gaps before they become a fine case and interlinks with the DPA review skill of the data protection area.
⚠️ Currency (as of 2026-07): Since 12.09.2025 cloud contracts have also been subject not only to the GDPR but also to the Data Act (Regulation (EU) 2023/2854). Its Chapter VI (Art. 23–31) governs the switching between data processing services and applies regardless of whether personal data is affected — a pure Art. 28 GDPR review therefore falls short.
- Switching charges (“switching charges”) will be completely abolished by 12.01.2027. Until then, only cost-based reduced charges are permissible; flat-rate exit or data export fees are already impermissible now.
- Art. 25 requires contractual provisions on support with switching (exit assistance, transition periods, data export in a structured, commonly used and machine-readable format).
- Art. 13 subjects unilaterally imposed contract terms on data access in B2B relationships to an independent fairness review — in addition to Sections 305 et seq. of the German Civil Code (BGB).
- The German Data Act Implementation Act (DADG) was adopted by the Bundestag on 26.03.2026 and promulgated in the Federal Law Gazette of 29.05.2026 . The competent authority is the Federal Network Agency (announcement 30.05.2026). In the same package of 26.03.2026, the German implementation act for the Data Governance Act was adopted; there too the BNetzA supervises data intermediation services and data altruism organisations.
Individual sections of the DADG must be verified against the promulgated text before use in client-facing contexts.
[unverifiziert - prüfen]
Inputs
- Cloud model (IaaS, PaaS, SaaS) and provider
- Categories of data processed (standard, special categories Art. 9, employee data)
- Location of processing / storage (EU, USA, other third country)
- Provider's corporate group affiliation (US parent? Cloud Act access?)
- Existing DPA draft and list of sub-processors
- Existing TOM documentation, certifications (ISO 27001, C5)
Sub-agent architecture
The review is conceptually divided among three roles. An DPA agent reviews the data processing agreement against the catalog of obligations under Art. 28(3) GDPR (subject matter, duration, binding instructions, sub-processors, support obligations, deletion, audit). A TOM agent assesses the technical and organizational measures under Art. 32 GDPR (encryption, pseudonymization, availability, resilience, regular review) and compares them with the risk of the data categories. A transfer agent reviews every third-country reference under Chapter V (adequacy decision, standard contractual clauses, transfer impact assessment, supplementary measures). A switching agent finally reviews the exit and switching clauses against Art. 23–31 Data Act (switching fees, exit support, export formats) as well as Art. 13 Data Act (abusive data access clauses) — this axis is independent of the GDPR and also covers non-personal data. The roles report their findings to a consolidating assessment; a deficiency on one axis blocks overall conformity. Case law and supervisory decisions are cited only when verified, otherwise marked with [unverifiziert – prüfen] .
Procedure
1. Clarification of roles and applicability
- Is there processing on behalf (instruction-bound processing) or joint controllership (Art. 26) or the provider's own controllership?
- Only in the case of processing on behalf is a DPA under Art. 28 GDPR the correct type of contract.
2. Review of DPA content (Art. 28 GDPR)
Mandatory contents under Art. 28(3) GDPR:
- Subject matter, duration, nature and purpose of the processing, data categories, circle of data subjects
- Processing only on documented instructions
- Confidentiality obligation of employees
- Measures under Art. 32 GDPR
- Authorization and contracts with sub-processors (Art. 28(2), (4))
- Support with data subject rights and with Art. 32–36
- Deletion or return of the data after the end of the contract
- Demonstration and auditrights of the controller
3. Technical and organizational measures (Art. 32 GDPR)
- Encryption (in transit and at rest), pseudonymization
- Ensuring confidentiality, integrity, availability, resilience
- Restorability after an incident; regular testing
- Risk appropriateness, in particular for special categories of data (Art. 9)
4. Third-country transfer (Chapter V, Art. 44 GDPR et seq.)
- Adequacy decision (Art. 45) — e.g. EU-US Data Privacy Framework for certified US providers
- Standard contractual clauses (Art. 46) + Transfer Impact Assessment + possibly supplementary measures (Schrems II)
- Assess access risks by third-country authorities (Cloud Act)
- Separately safeguard sub-processors in third countries
5. Provider switching and exit under the Data Act (Art. 23–31 Regulation (EU) 2023/2854)
This review runs alongside the GDPR review and covers all data processed in the cloud, including non-personal data.
a) Switching charges (Art. 29). Charges for switching to another provider or back to one's own infrastructure will be completely abolished by 12.01.2027. During the transition period, only cost-based reduced charges are permissible, and these must not exceed the costs actually incurred.
Checkpoints in the contract:
- Does the contract contain data export, exit or migration fees? Flat rates and "egress fees" for switching are already impermissible.
- Has a phase-out provision as of 12.01.2027 been included that eliminates the charges from that date?
- Are remaining charges justified and substantiated on a cost basis?
b) Exit support (Art. 25). The contract must make switching practically possible:
- switching period and termination modalities fixed by contract
- transition period with active cooperation of the provider
- Export of all data and digital assets in a structured, commonly used and machine-readable format
- Description of the exportable data and the available interfaces
- Deletion of the data at the former provider after completion of the switch — here Art. 25 Data Act interlinks with the deletion obligation under Art. 28(3)(g) GDPR
- No contractual or technical switching obstacles (lock-in through proprietary formats without an export path)
c) Abusive clauses (Art. 13). Unilaterally imposed clauses on data access in B2B contracts are subject to a separate abuse review. It applies alongside the standard terms review under §§ 305 et seq. BGB and must also be examined where the standard terms review does not apply.
d) Jurisdiction and enforcement. The competent German authority under the DADG (Federal Law Gazette 29.05.2026, announcement 30.05.2026) is the Bundesnetzagentur — not the data protection supervisory authority. Data Act violations and GDPR violations are thus pursued by different authorities ; both proceedings can run in parallel. Check the sanctions framework and procedural rules against the promulgated DADG text. [unverifiziert - prüfen]
6. Documentation and accountability
- Entry in the record of processing activities (Art. 30)
- Data protection impact assessment (Art. 35) for high risk
Risks / typical mistakes
- Missing DPA — cloud use without a DPA under Art. 28 GDPR is a standalone infringement; risk of a fine under Art. 83 GDPR.
- Third-country transfer without a viable legal basis — US providers without DPF certification or without standard contractual clauses together with a TIA breach Chapter V (Art. 44 GDPR).
- Sub-processors not reviewed — missing authorization or onward transfer of obligations breaches Art. 28(4) GDPR.
- Fine — inadequate measures under Art. 32 GDPR or an unlawful transfer can trigger fines of up to EUR 20 million / 4% (Art. 83 GDPR).
- Cloud contract reviewed only under the GDPR — the Data Act has applied since 12.09.2025 and covers also non-personal data. A purely Art. 28 review completely overlooks the switching and exit obligations of Art. 23–31.
- Leaving switching and data export charges in the contract — they will cease entirely by 12 January 2027; until then only cost-based reduced charges are permissible. Flat-rate exit or egress fees are already unlawful today, even if the provider continues to invoice them.
- No exit support clause under Art. 25 — the switching period, transition period, export format and the provider's duties to cooperate must be contractually governed; a de facto functioning export is not sufficient.
- Deletion obligations not interlinked — Art. 25 Data Act (deletion at the former provider after switching) and Art. 28(3)(g) GDPR (deletion/return after contract end) must be governed together, otherwise a regulatory gap remains.
- Art. 13 Data Act overlooked alongside Sections 305 et seq. of the German Civil Code — data access clauses unilaterally imposed in B2B contracts are subject to an independent abuse of law review, which also applies where the standard terms review does not reach.
- Wrong supervisory authority addressed — for the Data Act in Germany, pursuant to the DADG (Federal Law Gazette 29 May 2026), the Federal Network Agency is responsible, not the data protection supervisory authority. Data Act and GDPR proceedings run separately and can be conducted in parallel.
Output format
CLOUD-AUFTRAGSVERARBEITUNG — <Dienst / Anbieter> — <Datum>
I. Rolle: [Auftragsverarbeitung / gem. Verantwortl. / eigen]
II. AVV (Art. 28 DSGVO)
Vollständigkeit: [✓ / 🔴 lückenhaft] Fehlend: <…>
Sub-Auftragsverarbeiter: [genehmigt / ungeregelt]
Audit / Löschung: [✓ / 🔴]
III. TOM (Art. 32 DSGVO)
Verschlüsselung / Risiko: [angemessen / ⚠️]
IV. Drittlandtransfer (Art. 44 DSGVO)
Standort: [EU / USA / Drittland]
Grundlage: [Angemessenheit / SCC + TIA / 🔴 keine]
V. Wechsel / Ausstieg (Data Act Art. 23–31)
Wechselentgelte: [keine / kostenbasiert / 🔴 pauschal unzulässig]
Auslauf zum 12.01.2027: [geregelt / 🔴 fehlt]
Ausstiegshilfe Art. 25: [Frist / Übergang / Exportformat — ✓ / 🔴]
Löschung beim Altanbieter: [✓ / 🔴]
Art. 13 (missbräuchliche Datenzugangsklauseln): [✓ / ⚠️]
Zuständige Behörde: BNetzA (DADG) — getrennt von der Datenschutzaufsicht
VI. Dokumentation
VVT / DSFA: [✓ / offen]
Bußgeldrisiko (Art. 83 DSGVO): <Einschätzung>
Data-Act-Risiko (BNetzA): <Einschätzung>
Handlungsempfehlung: <…>
Sources
- Art. 28 GDPR (processors)
- Art. 32 GDPR (security of processing)
- Art. 44 et seq. GDPR — Chapter V (third-country transfer), Art. 45, 46
- Art. 83 GDPR (fines)
- EU-US Data Privacy Framework; EDPB Recommendations 01/2020 (supplementary measures)
[unverifiziert – prüfen] - Regulation (EU) 2023/2854 (Data Act) — applicable since 12.09.2025; Art. 13 (unfair contract terms), Art. 23–31 (switching between data processing services), in particular Art. 25 (exit support) and Art. 29 (switching charges, complete elimination by 12.01.2027)
- Data Act Implementation Act (DADG) — Bundestag 26.03.2026, Federal Law Gazette 29.05.2026; competent authority: Federal Network Agency (announcement 30.05.2026). Individual provisions
[unverifiziert - prüfen] - Federal Network Agency — competent authority for the Data Act and the Data Governance Act (data intermediation services, data altruism organisations)