{"id":73419,"date":"2026-08-05T22:34:43","date_gmt":"2026-08-05T20:34:43","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73419"},"modified":"2026-08-05T22:34:43","modified_gmt":"2026-08-05T20:34:43","slug":"dsgvo-it-cloud","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/datenschutz-informationsschutz\/dsgvo-it-cloud\/","title":{"rendered":"Implement GDPR in IT and Cloud in practice"},"content":{"rendered":"
\"Datenschutz<\/span>

\u2190 Data protection & information protection<\/a><\/p>

Implement GDPR in IT and Cloud in practice<\/h1>

Process personal data in IT and cloud environments in a controlled manner, protect it and operate it in a traceable manner.<\/strong><\/p><\/div><\/div>\n\n\n\n

The GDPR does not require a blanket \u201ccompliant\u201d cloud solution, but rather risk-oriented processing with clear responsibilities and verifiable measures. For IT and the cloud, roles and authorisations, protective measures, retention and deletion, logging as well as contracts and data flows need to be clarified in particular. Microsoft 365 can support technical features; However, the specific assessment depends on usage, configuration, contract and operation.<\/p>\n<\/div>\n\n\n

Relationship to services and technologies<\/h2>\n\n
\"Datenschutz<\/figure>
\n

This classification does not replace legal advice or an assessment of data protection law. She translates coordinated requirements into technical and organisational control questions for IT and cloud.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Background<\/h2>\n\n

In cloud and Microsoft 365 environments, personal data is not only created in specialist applications: it can be found in emails, teams, files, identity data, devices, logs and backups. Teams therefore need a common picture of who processes which data, who has administrative rights and how decisions in the life cycle remain traceable.<\/p>\n\n\n\n

Data protection documentation alone does not control permissions. Conversely, a technical configuration does not in itself prove that processing is permitted. Data protection, IT, information security and specialist departments must combine their respective responsibilities.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n
\"Abstrakte<\/figure>
\n

The GDPR requires those responsible to implement appropriate technical and organisational measures and to be able to demonstrate their effectiveness and compliance with the regulation (in particular Article 5 Para. 2 and Article 24 GDPR). Data protection through technology design and data protection-friendly default settings must be taken into account when determining means and processing (Article 25 GDPR). Art. 32 GDPR requires a level of protection appropriate to the risk.<\/p>\n<\/div><\/div>\n\n\n\n

The distribution of roles is central for cloud services: a company can be the controller, while a service provider processes personal data as a processor. Art. 28 GDPR sets requirements for its selection and contractual binding. Whether this classification is correct, which transfers take place and which legal bases apply must be checked for the specific processing operation.<\/p>\n\n\n\n

Cloud roles, order processing and third country transfers are separate test questions: The role and contract test according to Art. 28 does not automatically answer whether data is transferred to a third country and what requirements apply. If transfers come into consideration, the recipient, transmission channel and additional protective measures must be assessed based on the specific processing.<\/p>\n\n\n\n

A data protection impact assessment (DPIA) is also not a standard consequence of every cloud use. It must be included as a test question if processing is likely to result in a high risk for the rights and freedoms of natural persons. The standard data protection model (SDM) from BfDI and DSK offers a structure to translate GDPR requirements into technical and organisational measures; it does not replace a legal assessment.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n