The Cloud Backup Across Borders
A 30-person accountancy firm stores client tax records in a cloud accounting suite. The provider's servers are in the EU, but its support team is in a country outside the EU with no adequacy decision, and engineers can access customer data remotely to fix tickets. The firm's contract with the provider is the provider's standard terms, which say the provider is a 'processor' but also let it use aggregated data 'for product improvement'. The firm has never carried out a risk assessment, has no documented retention schedule, and stores client records indefinitely because 'clients might come back'. A client asks where their data is held and who can see it.
1. Map the roles and identify the transfer issue.
Read the worked answer
Roles:
- The accountancy firm is the controller for client tax data.
- The cloud provider is a processor for hosting/support, but the 'product improvement' clause is a warning sign: if the provider uses data for its own purposes, it may be a controller for that use, which the firm has not authorised.
Transfer issue:
- Remote access by support staff in a non-adequate country is a restricted transfer, even though the servers are in the EU - access counts.
- A lawful transfer needs a transfer mechanism (e.g. standard contractual clauses) plus a transfer risk assessment, and supplementary measures if needed.
- The standard terms alone may not include an appropriate mechanism for that access, and the firm has not verified it.
So the firm cannot currently assure the client that access is lawful and controlled.
2. What should the firm tell the client, and what must it fix in the contract and internally?
Read the worked answer
Tell the client:
- Where data is stored (EU) and that support access occurs from a named country.
- Who can access it (provider support engineers under ticket), and the safeguards relied on.
- Retention: state the actual period once set; 'indefinitely' is not a lawful retention position.
Contract fixes:
- A data processing agreement with processor obligations: process only on instructions, confidentiality, security, sub-processor controls, assistance with rights requests, breach notification, deletion on exit.
- Remove or tightly bound the 'product improvement' use - the firm must authorise any controller-like use or prohibit it.
- A valid transfer mechanism and a documented transfer risk assessment for the support access.
Internal fixes: a retention schedule (e.g. statutory tax-record periods, then delete), a documented risk assessment, access reviews, and a record of processing. The firm should also check whether any other tool holds client data.
3. A client asks for deletion of records from a closed engagement three years ago. The firm has kept everything. How should it decide?
Read the worked answer
Apply the erasure right against legal retention duties.
- Tax and accounting law typically requires records to be kept for a set period; if the engagement is within that period, the firm must retain and should refuse erasure for those records, explaining the legal basis.
- Records outside the retention period, or data not required by law, should be deleted - 'clients might come back' is not a legal ground.
- The firm should distinguish categories: statutory records (retain), convenience copies and marketing data (delete).
- Respond within one month, explain what was deleted and what was retained and why, and record the decision.
The underlying failure is the absence of a retention schedule; the firm should adopt one so future requests are routine rather than judgement calls.