GDPR Cloud Migration: 12-Point Checklist
TL;DR
- 12-point checklist for a GDPR-compliant cloud migration
- Provider comparison: EU region, list of sub-processors, ISO 27001, BSI C5
- DPA before the migration starts: it sets out the subject matter, duration, nature and purpose, types of data and categories of data subjects Art. 28(3) GDPR
- TIA (transfer impact assessment) for US providers as a practical recommendation even under the DPF; for providers in other Third Countries the standard contractual clauses SCC 2021/914 usually carry the transfer
- Update the record of processing activities: recipients, Third Country transfers including safeguards, erasure periods, reference to the TOMs Art. 30(1) GDPR
- DPIA in advance where a high risk is likely Art. 35(1) GDPR; in Germany this triggers the obligation to appoint a DPO with no headcount threshold § 38(1) sentence 2 BDSG
- Personal Data Breach: notification without undue delay and, where feasible, within 72 hours of becoming aware yourself Art. 33(1) GDPR
- DE/AT: the notification address and the DPO threshold differ § 40(1) BDSG · § 18(1) DSG; the fine range for Art. 25 to 39 is up to EUR 10,000,000 or, in the case of an undertaking, up to 2 % of total worldwide annual turnover Art. 83(4) GDPR
- Exit plan: data export format + proof of erasure + transition
Main article: DPA template under Art. 28 GDPR — it sets out the 8 mandatory contents of a data processing agreement in detail.
What a cloud migration triggers under data protection law
It makes the cloud provider a Data Processor — and thereby triggers the set of obligations that this checklist spreads across 12 working steps. Cloud hosting is processing on behalf of a controller: an external body processes personal data for you on your instructions, without any processing interest of its own. The contract under Art. 28 and the record under Art. 30 apply to every migration involving an external provider — the exemption in Art. 30(5) GDPR only applies cumulatively and therefore almost never in practice. The Third Country safeguard only applies where a Third Country element is present; the impact assessment only where a high risk is likely; notification of data subjects only in the event of a breach with a high risk.
| Block of obligations | What this means for the migration | Source |
|---|---|---|
| Processing on behalf of a controller | Only providers offering sufficient guarantees of appropriate TOMs; contract with the statutory minimum content | Art. 28(1), (3) GDPR |
| Third Country transfer (only where a Third Country element exists) | One safeguard per Third Country element — details in point 3 | SCC 2021/914 · DPF (EU) 2023/1795 |
| Technical and organisational measures | One central TOM concept, referenced by the DPA annex and by the record — no separate TOMs for each processing activity | Art. 28(3)(c), (h) GDPR · Art. 30(1)(g) GDPR (general description under Art. 32(1)) |
| Record of processing activities | Bring recipients, Third Country transfers including safeguards, erasure periods and the TOM reference up to date | Art. 30(1) GDPR |
| Impact assessment (only where the risk is high) | In advance, where the processing is likely to result in a high risk — in particular where new technologies are used | Art. 35(1) GDPR |
| Data subject rights | Reply without undue delay and in any event within one month; an extension by 2 months is possible, with notification of that extension within one month | Art. 12(3) GDPR |
| Personal Data Breaches | Notification without undue delay and, where feasible, within 72 hours of becoming aware; notification of data subjects only where the risk is high | Art. 33(1) GDPR · Art. 34(1) GDPR |
The order of the 12 points is the practical structure of this checklist, not a statutory sequence — when an individual obligation applies is stated in the source alongside it.
Pre-migration (1-4)
Whether the migration is lawful is decided before the first data move: provider comparison with DPF or EU hosting status (1), DPA negotiation with the mandatory clauses (2), TIA where Third Country components are involved (3) and DPIA for high-risk processing (4). Provider selection, contract and risk assessment must be in place before personal data flows — and where a Third Country element exists, the safeguard for it as well.
| Point | What you do | Why — source |
|---|---|---|
| 1 Provider comparison | Document the hosting region and the complete list of sub-processors for each provider; if a Third Country element then exists, file the appropriate safeguard under point 3 | Only Data Processors offering sufficient guarantees of appropriate TOMs — Art. 28(1) GDPR |
| 2 DPA negotiation | Work through the 8 mandatory contents: subject matter and duration, nature and purpose, types of data and categories of data subjects, obligations and rights of the controller, confidentiality, sub-processing, assistance with data subject rights, TOM annex with a right to audit | Minimum content Art. 28(3) GDPR; sub-processors only with prior authorisation Art. 28(2) GDPR |
| 3 TIA | For each Third Country component, an annex with the safeguard (SCC 2021/914 or proof of DPF certification for DPF-certified US companies), a transfer impact assessment and additional technical measures such as encryption and Pseudonymisation | The safeguard is mandatory for US Data Processors and sub-processors in Third Countries; the TIA and additional measures belong in the same annex as a practical recommendation, even under the DPF — SCC 2021/914 |
| 4 DPIA | Assess before the migration and carry one out where needed — the standard cases are profiling with legal effect, large-scale processing of special categories and systematic large-scale monitoring of publicly accessible areas | Obligation in advance where the risk is high Art. 35(1) and (3) GDPR |
Point 4 has a side effect: where processing is subject to an impact assessment under Art. 35 GDPR, a data protection officer must be appointed in Germany regardless of the number of persons employed (§ 38(1) sentence 2 of the German Federal Data Protection Act (BDSG)); in Austria the obligation to appoint follows from Art. 37 GDPR alone. Practical recommendation on point 2: check the provider's DPA against the 6 typical DPA mistakes — a generic template contract from the internet, a missing list of sub-processors, a missing SCC or DPF annex where there is a Third Country transfer, a right to audit rendered ineffective by long lead times ("with 6 months' notice"), unregulated return of data after the end of the contract, and a 2018 version of the DPA that does not yet know the standard contractual clauses 2021/914.
Migration (5-8)
Points 5 to 8 aim at demonstrability: data flow mapping with an update to the record of processing activities (5), encryption at rest and in transit (6), customer lockbox settings (7) and activating audit logging (8). In doing so you record which data moves into which system, who at the provider may access your content and what of that is logged.
| Point | What you do | Why — source |
|---|---|---|
| 5 Data flow mapping | For each processing activity, record which data moves into which system, and update recipients, Third Country transfers including safeguards, erasure periods and the TOM reference in the record | Mandatory particulars Art. 30(1) GDPR; if you are a Data Processor yourself, the shorter catalogue with 4 particulars applies Art. 30(2) GDPR |
| 6 Encryption | Activate at rest and in transit, and document key management separately | Effective encryption can make notification of data subjects unnecessary, as long as the key has not been compromised as well — Art. 34(3) GDPR |
| 7 Customer lockbox | Practical recommendation: check which approval procedures your provider offers for support access to your content, and activate them first and foremost where special categories under Art. 9 GDPR are processed or where the processing requires a DPIA (point 4). The chosen setting belongs in the central TOM concept referenced by the DPA annex and the record. Irrespective of that, access is secured contractually through the DPA: right to issue instructions, confidentiality undertaking from the Data Processor's staff, information in the event of a breach and a right to audit | The obligations and rights of the controller as well as confidentiality are among the mandatory contents of a DPA Art. 28(3) GDPR |
| 8 Audit logging | Activate logging, set a retention period, and test once that the logs can be evaluated. Practical recommendation on the period: use the 90 days of the restore period from the exit plan as a guide and record the chosen period in the TOM concept — so that the logs can still support the notification particulars under Art. 33(3) GDPR even if a breach only comes to light later | Without logs, the notification particulars — categories of data, approximate number of data subjects and records — cannot be supplied Art. 33(3) GDPR |
Practical observation on the record: 3 mistakes recur in a migration — outdated recipient lists because the replaced system was never removed; a missing Third Country reference for US services; erasure periods without a specific figure. In practical experience, outdated recipient lists and missing erasure periods are also among the frequent errors in records of processing activities outside migrations. The TOM reference belongs in the record as a reference, not as copied TOM content. Practical recommendation: keep the record in an editable format rather than as a PDF — in practice, a record kept in Excel is sufficient (DE); what matters is the content, how current it is and its legibility.
Post-migration (9-12)
After the move, the migration is only complete once people, documents and notification routes are aligned with the new setup: training of staff (9), updating the Privacy notice (10), an incident procedure with cloud escalation (11) and a documented exit plan with return and erasure of data (12).
| Point | What you do | Why — source |
|---|---|---|
| 9 Training | Train staff on the new setup: sharing and links, storage locations, the reporting route where a breach is suspected | Awareness-raising and training of the staff involved are part of the DPO's monitoring task — Art. 39(1)(b) GDPR |
| 10 Privacy notice | Add new categories of recipients and Third Country transfers, and check the DPO's contact details | Information obligations Art. 13 GDPR · Art. 14 GDPR; in Austria the Austrian Data Protection Authority (Datenschutzbehörde) must be named as the complaints body Art. 13(2)(d) GDPR |
| 11 Incident procedure | Add the cloud escalation: provider contact, who classifies internally, which notification portal, who sends it | Notification without undue delay and, where feasible, within 72 hours of becoming aware Art. 33(1) GDPR; document every breach, including those that are not notifiable Art. 33(5) GDPR |
| 12 Exit plan | In practice: keep the export format, restore period and erasure with confirmation as a contract annex | Return and erasure of data after the end of the contract are expressly on the DPA checklist to be completed before signature; the right to audit is one of the mandatory contents of a DPA Art. 28(3)(h) GDPR |
Point 11 includes the notification address, and that differs: in Germany, companies as non-public bodies notify the authority competent under state law (§ 40(1) BDSG) — every federal state runs its own portal, in Bavaria for example the Bavarian State Office for Data Protection Supervision. The BfDI is only competent for federal public bodies and certain providers of telecommunications services (§ 9(1) BDSG). In Austria, notification goes to the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) of the Austrian Data Protection Act (DSG)). Practical recommendation for the 72-hour grid: 0-2 h detection and crisis team, 2-8 h containment and initial forensics, 8-24 h classification of data types, numbers and risk, 24-48 h drafting the notification and the management statement, 48-72 h sending the notification and documenting the confirmation.
Provider comparison: groups of providers and their Third Country element
The comparison is decided on 4 documentable points: hosting region, complete list of sub-processors, Third Country safeguard and TOM annex including the right to audit. The following table sorts the providers in this checklist by their Third Country element — hosting region, list of sub-processors and TOM annex have to be obtained and filed separately for each provider.
| Group of providers in this checklist | Third Country element | What you file for each provider — source |
|---|---|---|
| EU: IONOS Cloud, Stack-IT, OVHcloud, Hetzner | None from the hosting region itself; it can arise through sub-processors | Contractually assured hosting region and complete list of sub-processors; engagement only with the prior authorisation of the controller Art. 28(2) GDPR |
| US: AWS (with EU region), Azure (with EU data boundary), GCP (with EU region) — DPF-certified | Yes, through the US company | Proof of DPF certification or SCC 2021/914, plus the remaining annex components under point 3 DPF (EU) 2023/1795 · SCC 2021/914 |
| Providers or sub-processors in other Third Countries | Yes, without the DPF route | As a rule the standard contractual clauses SCC 2021/914, plus the remaining annex components under point 3 SCC 2021/914 |
| All groups | — | A specific TOM annex instead of the formula "appropriate TOMs"; a right to audit without an ineffective lead time Art. 28(1) GDPR · Art. 28(3)(c), (h) GDPR |
As types of evidence, this checklist uses ISO 27001 and BSI C5. Art. 28(1) GDPR requires sufficient guarantees of appropriate technical and organisational measures — which evidence you rely on for that is for you to decide and document. For Microsoft 365, in this checklist's assessment, the provider's standard DPA is not enough; what has to be agreed is an activated EU Data Boundary, a DPF safeguard for US sub-processors, telemetry configuration and Copilot tenant isolation. Adopt the list of sub-processors in full — it is the bridge between the DPA and the record, and the check at which a hidden Third Country element becomes visible. Practical recommendation: record the date on which you retrieved the list of sub-processors.
Exit plan
The exit plan answers 3 questions before they become urgent: in which format you get your data back, how long it can be restored afterwards, and how erasure at the provider is evidenced. For this, the checklist assumes open data format standards (Parquet, JSON, CSV), a restore period of 90 days and mandatory erasure with confirmation. The 90 days are this checklist's practical value — which period your contract supports is a matter for negotiation with the provider.
The legal anchor is the DPA: unregulated return of data after the end of the contract is one of the 6 typical DPA mistakes (see point 2), and without a robust right to audit, erasure cannot be verified — the right to audit should therefore be expressly anchored in the contract. Practical recommendation: treat the exit plan as a contract annex with a version date and carry it along at every DPA review. After an actual exit, the former provider should be removed from the record of processing activities (point 5).
Germany and Austria: what differs
In substance, Art. 28, Art. 30 and Art. 33 GDPR apply in the same way in both countries; what differs is supervision, the DPO threshold and individual additional national obligations.
| Topic | Germany | Austria |
|---|---|---|
| Supervision and notification address | Non-public bodies: the authorities competent under state law § 40(1) BDSG; the BfDI only for federal bodies and certain telecommunications providers § 9(1) BDSG | The Datenschutzbehörde as the national supervisory authority § 18(1) DSG |
| Data protection officer | From 20 persons permanently engaged in automated processing § 38(1) sentence 1 BDSG; with no headcount threshold where processing requires a DPIA § 38(1) sentence 2 BDSG | No additional threshold — the obligation follows from Art. 37 GDPR; § 5 DSG governs secrecy and, in the public sector, freedom from instructions |
| Processing on behalf of a controller | Art. 28 GDPR | Art. 28 GDPR with no Austrian special rule; in addition, the data secrecy obligation of employees § 6 DSG |
| Record of processing activities | Art. 30 GDPR | Art. 30 GDPR identical in wording — same mandatory particulars, no differing thresholds or periods |
| Fine range for infringements of Art. 25 to 39 | Up to EUR 10,000,000 or, in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher Art. 83(4) GDPR | The same range Art. 83(4) GDPR; in addition, proportionate application, in particular a reprimand instead of a fine for first-time infringements § 11 DSG |
| National sanctions alongside Art. 83 | Administrative offence of up to EUR 50,000, covering only certain infringements: incorrect handling of a request for access and consumer information under § 30 BDSG § 43(2), (3) BDSG | Administrative penalty of up to EUR 50,000, only subsidiary (where the act does not already fulfil an element under Art. 83 GDPR) and only for certain intentional acts such as unlawful access or transfer in breach of the data secrecy obligation § 62(1) DSG |
Frequently asked questions
Which cloud provider for SMEs?
What if the DPF collapses?
Does the DPA have to be signed before the migration starts?
When do we need a DPIA for the migration?
What does the migration change in the record of processing activities?
The provider notifies us of a breach — when does our 72-hour period start?
How quickly do we have to answer access requests in the new setup?
What fine risk does a faulty migration carry?
Does anything different apply to an Austrian company?
Sources
- Regulation (EU) 2016/679 (GDPR) — German full text, EUR-Lex (As at: 2 May 2026, applicable since 25 May 2018)
- German Federal Data Protection Act (BDSG) — gesetze-im-internet.de (As at: continuously updated, service unit of the Federal Ministry of Justice)
- Austrian Data Protection Act (DSG) — RIS of the Federal Chancellery (As at: version in force)
- Commission Implementing Decision (EU) 2023/1795 — EU-US Data Privacy Framework (As at: 17 August 2026)
- General Court T-553/23 — Latombe v Commission (DPF action dismissed) (judgment of 3 September 2025; appeal C-703/25 P pending, as at: 17 August 2026)