Assessing software and cloud providers: a plain-language glossary on personal data

01

What it means to assess a provider from the personal data perspective

When a company entrusts data to a software or cloud provider, it must first understand what personal data is: any information that allows a person to be identified, directly or indirectly, such as name, email, customer code or browsing history (citation-0). Assessing a provider means checking that it protects the integrity, availability and confidentiality of this data, the three elements on which security is based according to the EDPB guide (citation-2).

02

Why risk must be measured before choosing

• Unauthorized access to personal data constitutes a breach of confidentiality, for example the disclosure of payslips (citation-2).
• Unauthorized modification of data is a breach of integrity, such as the alteration of access logs (citation-2).
• Loss of access to data is a breach of availability, for example unreachable documentation (citation-2).
• If the processing carries a high risk to individuals, the GDPR requires an impact assessment, the DPIA (citation-3).

03

The practical path for assessing a provider

Steps

1. Identify which personal data will pass to the provider and why they are processed (citation-0).
2. Identify sources of risk, human and non-human, internal and external to the provider (citation-2).
3. Check existing or planned measures: access control, backups, traceability, encryption (citation-3).
4. Estimate severity and likelihood of each risk on a shared scale (citation-3).
5. Schedule periodic checks with an action plan monitored at the highest levels of the organization (citation-3).

04

A hypothetical case: choosing a cloud provider for the customer database

Hypothesis: a small business wants to entrust its customer database to a cloud provider, with names, emails and purchase history — data that allows people to be identified directly or indirectly (citation-0). Before signing, the company lists the possible sources of risk, from an external system administrator to a non-targeted cyber attack, and checks whether the provider offers the measures already planned to mitigate them, as required by the risk assessment process (citation-2, citation-3). Only after this check does it assign a priority level to the decision.

05

Elements to ask or verify with the provider

• Regular training of data handlers on privacy-related risks (citation-1).
• A binding internal policy on data protection and security (citation-1).
• Data protection by design and by default (citation-1).
• Data minimization: processing only what is adequate and necessary (citation-1).
• Automatic session lock, firewall, updated antivirus and backups (citation-1).

06

How to organize the assessment with the support of management software

A company may choose to configure, together with its software partner, a provider register that lists which personal data flows to each system, who is responsible for assessing it, and when the last risk check was carried out (citation-3). This is a suggested operational choice, not an obligation arising from the software: the company remains responsible for defining roles, traceability and review frequency according to its own risk management plan, documenting procedures clearly for each category of data handler (citation-3, citation-4).

07

Quick clarifications on the glossary

• Personal data also includes indirect identifiers such as a customer code or a booking reference (citation-0).
• Data security is assessed on three axes: confidentiality, integrity and availability (citation-2).
• A DPIA is required when the processing presents a high risk to the individuals concerned (citation-3).

08

The next step

Before signing a contract with a software or cloud provider, list the personal data involved, the sources of risk and the measures already planned, then schedule a periodic check with a monitored action plan (citation-3).