The GDPR has applied directly in all EU member states since 25 May 2018. Several articles are particularly relevant for the technical infrastructure of data storage.

Art. 32 GDPR requires technical and organizational measures appropriate to the risk — including encryption of personal data, pseudonymization, and the ability to rapidly restore the availability, integrity and confidentiality of personal data after an incident. This directly establishes the need for robust backup infrastructure.

Art. 28 GDPR governs data processing agreements: every cloud provider acting as a data processor must be contractually bound. The controller remains responsible for compliance with all GDPR requirements — even when data is held by an external provider. This includes the question of whether the provider is subject to the US CLOUD Act.

Art. 17 GDPR (right to erasure) exists in tension with retention obligations (, HGB, medical records laws): retention obligations take precedence over the GDPR erasure obligation as long as they apply. After the retention period expires, the GDPR erasure obligation takes effect. Modern systems support deadline-based retention management that meets both requirements within a single system.

Frequently asked questions

If statutory retention obligations (e.g., commercial, tax or medical law) apply, they take precedence over the GDPR right to erasure. After the retention period expires, Art. 17 GDPR applies: the data must then be deleted. Modern WORM systems support deadline-based retention management: after the retention period expires, data is released for controlled deletion.
This is a complex legal question. GDPR Art. 44–49 permits data transfers to third countries only under certain conditions. For the US, the EU-US Data Privacy Framework (2023) serves as the legal basis — but it is legally fragile. European data protection authorities have challenged the use of US cloud services for sensitive data categories in several decisions. For highly sensitive data (patient data, government data), on-premises storage is the most legally secure option.