Contents
- Who is the controller and who is the processor in SaaS
- Mandatory DPA under Art. 28 – what it must contain
- Sub-processors – the chain of responsibility
- International transfers – AWS, Google, Azure and the DPF
- Security measures under Art. 32 GDPR
- EDPB guidance on cloud services
- Practical checklist for IT companies
- The most common mistakes with cloud services
- Special cases
- Frequently asked questions
Short answer: When you use a cloud service (SaaS), your organisation is the controller of the personal data and the service provider is a processor within the meaning of the GDPR. You are required to conclude a data processing agreement (DPA) under Art. 28 GDPR, to control the sub-processors and to ensure a lawful mechanism for international transfers if the provider is outside the EEA. The absence of a DPA is a stand-alone infringement carrying a fine of up to EUR 10 million – even if there has never been a breach.
Cloud services – SaaS (software as a service), IaaS (infrastructure as a service), PaaS (platform as a service) – are used by almost every business today. From Google Workspace and Microsoft 365 to specialised CRM systems, accounting software and e-commerce platforms, almost every company in Bulgaria uses at least several cloud services that process personal data. Nevertheless, many organisations underestimate their GDPR obligations when working with and using these services.
Who is the controller and who is the processor in SaaS
Before signing a contract you need to determine whether you are the controller and the provider is the processor, or whether the two of you are joint controllers. EDPB Guidelines 07/2020 on the concepts of “controller” and “processor” provide a clear framework:
| Role | Who it is | What it determines | Example |
|---|---|---|---|
| Controller | Your organisation (the customer) | The purposes and means of the processing | You decide what employee/customer data to store in the CRM |
| Processor | The SaaS provider | Processes data only on your instructions | The CRM platform stores and processes the data on your behalf |
| Joint controller | A SaaS provider that also determines its own purposes | Both parties determine purposes and means | A platform that analyses your data for its own advertising purposes |
Caution: Some SaaS providers may act as joint controllers if they use your data for their own purposes – for example to improve algorithms through machine learning or for aggregated analytics. In that case an arrangement between joint controllers under Art. 26 GDPR is required, not just a DPA. Check each provider’s terms of use carefully.
Mandatory DPA under Art. 28 – what it must contain
Art. 28(3) GDPR lists eight mandatory elements that must be present in every data processing agreement (DPA) between a controller and a processor. In an inspection, the Commission for Personal Data Protection (CPDP) treats an incomplete DPA as equivalent to a missing one.
| No. | Mandatory clause | What it means in practice |
|---|---|---|
| 1 | Processing only on documented instructions | The SaaS provider has no right to process data for its own purposes. Your instructions must be in writing (including electronic form). |
| 2 | Confidentiality of personnel | The provider’s staff who have access to the data must be bound by a confidentiality obligation. |
| 3 | Appropriate security measures (Art. 32) | Encryption, access control, backups, vulnerability testing. The specific measures must be described in the DPA. |
| 4 | Management of sub-processors | Prior authorisation (specific or general) for engaging sub-processors. Under general authorisation: notification + right to object. |
| 5 | Assistance with data subject requests | The provider must help you respond to requests for access, rectification and erasure (Art. 15-22 GDPR). |
| 6 | Assistance with security, notification and DPIA | The provider must notify you of a breach without delay and assist with the impact assessment. |
| 7 | Deletion or return of data on termination | After the contract ends, the provider must delete or return ALL personal data – at your choice. |
| 8 | Audits and inspections | The provider must make available all information needed to demonstrate compliance and allow audits. |
The standard DPAs of the large providers. Google, Microsoft, AWS and most large SaaS platforms provide ready-made DPAs that usually cover the minimum requirements of Art. 28. Problems arise with: (1) smaller providers that have no DPA or offer incomplete ones; (2) terms that allow the provider to use data for its own purposes (analytics, ML); (3) the lack of a clear breach notification procedure.
Do you need a review of the DPAs with your cloud providers?
- Audit of your current DPAs for compliance with Art. 28 GDPR
- Drafting DPAs for providers that do not have one
- Review of the sub-processor chain and international transfers
Sub-processors – the chain of responsibility
Every large SaaS provider relies on a chain of sub-processors – hosting, CDN, backup, support. Art. 28(2) GDPR regulates this chain:
Two authorisation regimes
| Regime | How it works | In practice |
|---|---|---|
| Specific authorisation | The controller approves each sub-processor by name | Rare in SaaS – providers usually do not accept it |
| General authorisation | The controller authorises in principle + the provider notifies of changes + right to object | The standard model at Google, Microsoft, AWS |
General authorisation gives rise to four specific obligations for the provider:
- Maintain a public list of sub-processors (most large providers do)
- Notify you in advance when adding a new sub-processor
- Give you a right to object – and, if you object, give you the option to terminate the service
- Conclude a DPA with the sub-processor that mirrors the obligations of the main DPA
EDPB Opinion 22/2024: The controller has an obligation to verify that the processor actually complies with its obligations regarding sub-processors. It is not enough simply to sign the DPA and “forget” about it. Periodic checks (at least once a year) are part of the accountability principle under Art. 5(2) GDPR.
Practical example: the Google Workspace sub-processor chain
Scenario: a Bulgarian company uses Google Workspace
Controller: Your company
Processor: Google Ireland Limited (EEA)
Sub-processors: Google LLC (US) + dozens of infrastructure providers in various countries
What you need to do:
- Activate and accept the DPA from the Google Admin console (Settings → Legal → Data Processing Amendment)
- Check the sub-processors on Google’s public page
- Subscribe to notifications of changes to sub-processors
- Check the status of Google LLC in the EU-US Data Privacy Framework
- Document the transfer to the US and the applicable safeguards in your ROPA
International transfers – AWS, Google, Azure and the DPF
Most of the cloud services used by Bulgarian companies come from American companies. Chapter V of the GDPR (Art. 44-49) requires appropriate safeguards when personal data is transferred outside the European Economic Area (EEA).
Three main mechanisms for transfers to the US
| Mechanism | Status (2026) | Applicability |
|---|---|---|
| EU-US Data Privacy Framework (DPF) | In force since July 2023 (European Commission adequacy decision) | Only for US companies listed on dataprivacyframework.gov |
| Standard Contractual Clauses (SCCs) | Always applicable (Commission Decision 2021/914) | For all third countries; require a TIA (Transfer Impact Assessment) |
| Binding Corporate Rules (BCRs) | Approved by a supervisory authority | For intra-group transfers within multinational companies |
Checking DPF status – step by step
- Visit dataprivacyframework.gov/s/participant-search
- Search for the provider by name (e.g. “Google LLC”, “Amazon.com, Inc.”, “Microsoft Corporation”)
- Check the status: it must be “Active”
- Check the scope of the certification: “HR data” and/or “Non-HR data”
- Document the check with a date and a screenshot in your ROPA
Risk of a new Schrems ruling: The EU-US Data Privacy Framework is the subject of a legal challenge by NOYB and other organisations. If the Court of Justice of the EU annuls the DPF (as happened with Safe Harbor and the Privacy Shield), organisations that rely on it alone will be left without a legal basis for transfers. This is why the EDPB recommends SCCs as a fallback mechanism, even when the DPF applies.
The big three US cloud providers – GDPR status
| Provider | DPF status | DPA | SCCs | EU Data Residency |
|---|---|---|---|---|
| Google Cloud / Workspace | Active (Google LLC) | Yes, in the Admin Console | Included in the DPA | Yes, EU region selection |
| Microsoft Azure / 365 | Active (Microsoft Corp.) | Yes, DPA + Product Terms | Included automatically | Yes, EU Data Boundary (2023+) |
| AWS (Amazon) | Active (Amazon.com, Inc.) | Yes, AWS GDPR DPA | Included in the DPA | Yes, EU region (Frankfurt, Ireland, Stockholm) |
Security measures under Art. 32 GDPR
Art. 32 GDPR requires both the controller and the processor to implement “appropriate technical and organisational measures”. With cloud services responsibility is shared – the shared responsibility model is the standard at AWS, Google and Azure:
| Measure | Provider’s responsibility | Your responsibility |
|---|---|---|
| Physical security of the data centre | Yes | No |
| Encryption in transit (TLS) | Yes | Check the settings |
| Encryption at rest | Yes (usually by default) | Enable customer-managed keys if possible |
| Access management (IAM) | Provides the tools | You configure roles and permissions |
| Two-factor authentication (2FA/MFA) | Provides the option | You enable and enforce it |
| Backups | Infrastructure backups | Configuration + testing of restoration |
| Access logs (audit logs) | Generates the logs | You monitor and analyse them |
| Staff training | No | Yes – any of your employees with access must be trained |
Practical tip: In an inspection, the CPDP will ask you what security measures you apply. “We use Google” is not a sufficient answer. You must be able to state specifically: what encryption, what access control, what logs and how you monitor them. Document these measures in your ROPA.
EDPB guidance on cloud services
In January 2023 the EDPB published the results of a coordinated enforcement action on cloud services in the public sector. The conclusions also apply to private companies:
Key EDPB findings (2023)
- Most organisations do not have adequate DPAs – either there is no DPA at all, or the existing ones do not cover all the requirements of Art. 28(3)
- Lack of control over sub-processors – organisations do not follow the sub-processor lists and do not exercise their right to object
- Insufficient assessment of international transfers – no Transfer Impact Assessment is carried out for transfers to third countries
- Audit rights not exercised – the DPA provides for audits, but organisations never exercise them
- Unclear allocation of responsibilities – organisations do not know which measures are their responsibility and which are the provider’s
EU Cloud Code of Conduct (approved by the Belgian supervisory authority in May 2021)
The EDPB endorsed an industry Code of Conduct that standardises how cloud providers demonstrate compliance with the GDPR. Providers that adhere to it undertake to:
- Maintain a transparent list of sub-processors with a notification mechanism
- Offer a choice of EU/EEA data residency
- Provide a standardised DPA covering all the requirements of Art. 28
- Undergo an independent compliance audit
Tip: When choosing a new SaaS provider, check whether it adheres to the EU Cloud Code of Conduct or the CISPE Code of Conduct (for IaaS). This is a strong indicator of GDPR maturity.
Practical checklist for IT companies
The following steps apply both when launching a new cloud service and when reviewing those already in use:
Before you start using a service
- ✓ Determine the roles: are you the controller or the processor (or both)
- ✓ Check whether the provider offers a DPA covering all 8 elements of Art. 28(3)
- ✓ Establish where the data is physically stored (EU/US/another country)
- ✓ Check the DPF status of US providers on dataprivacyframework.gov
- ✓ Review the list of sub-processors and subscribe to notifications
- ✓ Carry out a Transfer Impact Assessment (TIA) if the data leaves the EEA
- ✓ Assess whether a DPIA is required (Art. 35 GDPR)
- ✓ Document the service in your ROPA
While using the service
- ✓ Enable 2FA/MFA for all users with access to personal data
- ✓ Configure minimum access rights (the principle of least privilege)
- ✓ Monitor the access logs (at least once a month)
- ✓ Follow the notifications of changes to sub-processors
- ✓ Carry out an annual review of the DPA and the security measures
- ✓ Test the procedure for restoring from backup
When terminating the service
- ✓ Export all personal data before termination
- ✓ Request written confirmation from the provider that the data has been deleted
- ✓ Check that the sub-processors have also deleted the data
- ✓ Update your ROPA
The most common mistakes with cloud services
- ✗ Using SaaS without checking whether the provider has a DPA
- ✗ Assuming that an NDA is a sufficient substitute for a DPA (it is not – the GDPR requires a separate DPA)
- ✗ Ignoring the sub-processor chain – “I don’t know who else has access”
- ✗ No TIA for transfers to the US (even under the DPF)
- ✗ Relying solely on the DPF without SCCs as a fallback mechanism
- ✗ No documentation of the security measures – “it’s in the cloud, so it’s secure”
- ✗ Not listing transfers outside the EEA in the ROPA
- ✗ Using free (free-tier) SaaS services for business data without reviewing the terms
- ✗ Not enabling 2FA for administrator accounts
- ✓ Review and activate the DPA with every provider (most offer it online)
- ✓ Subscribe to sub-processor notifications
- ✓ Document every transfer in your ROPA, stating the legal safeguards
- ✓ Keep SCCs as a fallback mechanism for US providers
- ✓ Configure EU data residency where available
- ✓ Enable MFA + encryption + audit logs
Audit of your cloud services for GDPR compliance
- Full review of the DPAs with all SaaS providers
- Assessment of international transfers and sub-processors
- Recommendations on security measures and configuration
- Update of the ROPA with all cloud services
Special cases
A SaaS provider from Bulgaria or the EU
When the provider is in the EEA, there is no need for an international transfer mechanism. However, a DPA under Art. 28 is still mandatory – location does not exempt you from the obligation to have a contract with the processor.
When your company is the processor (IT outsourcing)
If you offer SaaS or IT services to clients, you are the processor. In this case you must:
- Offer your clients a DPA covering Art. 28(3)
- Maintain a processor’s record under Art. 30(2)
- Obtain authorisation from the client (the controller) for each sub-processor
- Notify the client without delay of a data breach
- Remember that under Art. 82 GDPR the processor is also liable for damage
Multi-cloud and hybrid environments
When multiple cloud providers (multi-cloud) or a hybrid environment (on-premise + cloud) are used, each provider is a separate processor with a separate DPA. The data flows between providers must be mapped and documented in the ROPA.
Frequently asked questions
Who is the controller and who is the processor when using SaaS?
Your organisation is the controller – you determine what data is processed and for what purposes. The SaaS provider is the processor – it processes the data on your instructions. However, if the provider uses your data for its own purposes (e.g. analytics, ML), it may turn out to be a joint controller under Art. 26 GDPR.
What contract do I need with a cloud service provider?
A data processing agreement (DPA) under Art. 28 GDPR is mandatory. It must contain 8 mandatory elements: instructions, confidentiality, security, sub-processors, data subject rights, assistance with incidents, deletion on termination and audit rights. An NDA or a standard commercial contract does NOT replace a DPA.
What should I do if the SaaS provider is outside the EEA?
You must ensure a lawful mechanism for international transfers under Chapter V GDPR. For US providers, the easiest step is to check whether they are listed in the EU-US Data Privacy Framework (dataprivacyframework.gov). If they are not, Standard Contractual Clauses (SCCs) + a Transfer Impact Assessment are required. Even under the DPF, SCCs are recommended as a fallback mechanism.
What are the risks with SaaS sub-processors?
Each sub-processor is an additional link that can lead to a data breach or unauthorised access. You are responsible for verifying the entire chain. The risks include: sub-processors in third countries without adequate safeguards, no DPA between the processor and the sub-processor, and changes of sub-processors without your knowledge.
Who is liable for a data breach at a cloud service?
Under Art. 82 GDPR both the controller and the processor are liable for damage. The controller is liable if it did not choose a provider with sufficient guarantees or did not put a DPA in place. The processor is liable if it breached the instructions or its own obligations. The data subject may bring a claim against either of them.
Can I use Google Workspace/Microsoft 365 in compliance with the GDPR?
Yes, if configured correctly. Both platforms offer a DPA, are listed in the DPF, include SCCs and provide EU data residency options. However, you must: (1) activate the DPA; (2) configure an EU data region; (3) enable 2FA; (4) restrict access according to the principle of least privilege; (5) document everything in your ROPA.
What security measures should I require from the cloud provider?
At a minimum: encryption in transit (TLS) and at rest (AES-256), access control with MFA, audit logs, regular vulnerability testing, physical security of the data centres, and incident notification within 24-72 hours. Also check for certifications: ISO/IEC 27001:2022, SOC 2 Type II, CSA STAR.
How do I check whether a SaaS provider is certified under the EU-US DPF?
Visit dataprivacyframework.gov/s/participant-search and search for the company by name. The status must be “Active”. Also check the scope – whether it covers “HR data” and/or “Non-HR data”, depending on your needs. Document the check with a date for accountability purposes.
Comprehensive GDPR consultancy for IT companies
- Audit of cloud services and DPAs
- Preparation of a ROPA for IT and SaaS businesses
- Transfer Impact Assessment for international transfers
- Preparation for a CPDP inspection
