Belgium's Data Protection Authority announced the approval of a new international code of conduct for cloud service providers, laying out best practices for compliance with the EU's privacy legislation. The EU Cloud CoC is expected to make it easier for customers to check a service provider's compliance and whether they meet the requirements of the personal data protection rules.
The approval follows the EU Cloud CoC receiving a positive opinion on 19 May from the European Data Protection Board, which brings together all the national privacy regulators in the EU. In addition to approving the code, the Belgian regulator accredited Scope Europe to oversee implementation of the code. Scope will ensure that providers who sign up for the code live up to its tenets.
The code is expected to support a uniform application of the EU's General Data Protection Regulation across the different EU states. It looks specifically at application of article 28 of the GDPR on the requirements for processing personal data and how this applies for IaaS, SaaS and PaaS cloud service providers.
Microsoft Azure was the first company to announce its compliance with the code, while other major players like Google Cloud, Alibaba Cloud and IBM are also mentioned on the Cloud CoC website. They have all received level 2 compliance with the code, while Austria-based Fabasoft said it was the first to achieve level 3 compliance, the highest possible.
The EDPB also approved at its latest meeting the CISPE Data Protection Code of Conduct. Submitted by the French regulator Cnil, this code covers specifically cloud infrastructure providers (IaaS) and their compliance with the GDPR. It is aimed especially at organisations looking to ensure their data remains hosted in the EU.
