The EU adopted the General Data Protection Regulation (GDPR), creating a single, EU-wide privacy law to replace the 1995 Data Protection Directive. For cloud providers, it signaled that contracts, security controls, and customer tools would need to support stronger rights and accountability. The law included a transition period before the rules became fully applicable.
GDPR entered into force, starting the practical preparation period that ended in May 2018. Cloud providers and customers began mapping their roles as "controller" and "processor" and updating security and governance to match GDPR requirements. Regulators also began building guidance and coordination structures for the new regime.
The European Commission adopted an adequacy decision for the EU–U.S. Privacy Shield. This created a widely used (and debated) mechanism for some transfers of personal data from the EU to certified U.S. organizations, which mattered for cloud services with transatlantic operations and support. It did not replace the need for strong contracts and security, but it shaped compliance planning during the GDPR transition.
Microsoft publicly committed to being GDPR compliant across its cloud services by the May 2018 enforcement date. The statement framed GDPR as a major change and positioned Microsoft’s cloud compliance program (including Azure and Office 365) as a toolset customers could use for their own compliance work. This type of provider commitment helped shape customer expectations about contract terms and built-in controls.
Google Cloud stated it would support GDPR compliance across G Suite and Google Cloud Platform by May 25, 2018. It also signaled upcoming contract updates (important for the processor role and required terms, like instructions, security measures, and assistance). This helped customers begin vendor reviews and internal readiness planning earlier in the transition period.
Google rolled out updated data processing terms for G Suite and Google Cloud Platform to reflect GDPR requirements ahead of the May 2018 deadline. These updates mattered because GDPR requires specific contract clauses when a customer uses a cloud provider as a processor. Making terms available early supported compliance reviews, vendor management, and procurement updates.
AWS announced that all AWS services could be used in compliance with GDPR, following a service readiness audit. The timing—two months ahead of the enforcement date—was meant to give customers confidence as they finalized technical and contractual preparations. This was part of a broader pattern of cloud providers formalizing GDPR readiness statements as May 2018 approached.
AWS announced its GDPR Data Processing Addendum (DPA) was incorporated into its online Service Terms and would apply automatically from May 25, 2018 when processing personal data under GDPR. The DPA also included EU Model Clauses (standard contractual clauses), which were commonly used for certain international transfers. This kind of standardization reduced friction for customers onboarding and contracting for cloud services.
GDPR became fully applicable across the EU, replacing the older Directive framework. From this date, organizations (including cloud customers and providers) faced enforceable obligations such as defined legal bases for processing, stronger transparency, and breach notification expectations. Regulators also gained the ability to impose major administrative fines for serious violations.
On the same day GDPR became applicable, the European Data Protection Board (EDPB) replaced the Article 29 Working Party as the EU-level coordination body. This mattered for cloud compliance because consistent interpretation across countries affects cross-border services, shared infrastructure, and provider-customer arrangements. The EDPB’s work also supported more unified enforcement across the EU.
France’s data protection authority (CNIL) fined Google €50 million for GDPR violations related to transparency and valid consent for ad personalization. The case showed that regulators were willing to use GDPR’s stronger penalty powers and to scrutinize how information is presented to users. For cloud and digital platforms, it reinforced that compliance is not only technical—user-facing notice and consent design can also be decisive.
The UK Information Commissioner’s Office (ICO) issued a notice of intent to fine British Airways £183.39 million for GDPR infringements tied to a 2018 cyber incident. Although this was not a final penalty decision, it demonstrated how regulators would evaluate security arrangements and impose high, turnover-based sanctions for weak protections. The case helped clarify that cloud-era compliance includes strong security governance, not just privacy paperwork.
GDPR and cloud providers: policy changes, compliance programs, and enforcement (2016–2019)