Moving to the Cloud: Privacy
This post is the fourth in a series addressing concerns organizations may have that prevent them from moving the cloud-based solutions.
Few topics related to cloud computing create more passion than privacy. Knowing how well your organization’s information will be safe-guarded is key to trusting a service provider and the decision to go to the cloud in the first place.
Privacy, while closely related to security, differs in that security addresses access and protection of information, privacy addresses who can access data and how it may be used.
When considering privacy, organizations should start with three documents from the service provider:
- Terms of Service / Contract: Most cloud providers provide clear terms and conditions related to privacy in their terms of service. These include statements about content ownership and access rights; clauses covering confidential information; statements regarding the provider’s access to customer data and content; and terms related to how the service provider will respond to subpoenas and other third-party demands for data.
- Service Level Agreement: Many cloud providers include terms related to privacy in their service level agreement. In some cases, the SLA stipulates time frames for addressing privacy issues.
- Privacy Policy: Most cloud providers now have one or more privacy policies. These policies may be universal to the provider’s service, or may cover specific aspects of the services (such as use of the web site/portal).
When looking to choose a cloud solutions provider, look at all three documents. Verify that they are comprehensive and clear. Understand how they address any particular regulatory requirements for your organization. Validate that they are consistent — that no conflicts or gaps exist that could lead to confusion or misunderstandings down the road.
Make sure the review of privacy policies and looks at the specific customer agreements and policies. Many cloud providers offer “free” or “consumer” services with different terms and conditions than their paid (or free) solutions for business, government, education, and non-profits. Many organizations spin their wheels and raise unwarranted concerns by not focusing on the specific, applicable agreements, and policies.
Finally, review the privacy performance of the service provider. If they have had any sort of breach, or a privacy dispute, understand the nature, scope, and response. Understand if the breach was provider-related or due to the actions or inaction of the customer. Assess the appropriateness of the provider’s response given the nature of the issue.
Again, due diligence is key. A small amount of research, a few questions, and an accurate understanding of how a service provider plans and manages privacy will help organizations determine if the provider meets the organization’s privacy needs and priorities.
Next Post in the Series: Lock-In
Previous Post in the Series: Provider Reliabilty
