GDPR and cloud tools: five questions to ask every vendor

The new tool was bought after one demo. Three weeks later it is still sitting with the data protection officer, because nobody can say where the data lives. We see this a lot at media owners. The tool is rarely the problem. Usually five answers are missing that procurement could have asked for much earlier.

The effort pays off. If you use a service provider, you stay responsible for how it handles the data. Breaches of the obligations in Articles 25 to 39 GDPR, which include processing on behalf and data security, can be fined up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.

This is not legal advice. It helps you ask the right questions before the contract is signed.

1. Where does the data live, and who helps the vendor?

Almost every cloud tool relies on other providers: a data centre, an email service, sometimes an AI service. The GDPR calls them sub-processors. Your vendor may only use them with your prior specific or general written authorisation. Under a general authorisation, it has to tell you about intended changes so you can object.

So ask for a list: name, purpose, location. An answer like “we use leading cloud providers” is not enough.

30-second test: Search the vendor’s website for “sub-processor”. If there is no list, that is your first question for the sales team.

2. Is there a DPA, and what does it say?

If a vendor processes personal data on your behalf, you need a contract under Article 28 GDPR, the data processing agreement. That covers a marketing tool too: it holds at least your team’s user accounts, and often customer contacts.

Three points from the law should be in the draft. The vendor processes only on your documented instructions. After the contract ends it deletes or returns all data, whichever you choose. And it allows audits, including inspections.

A vendor that is ready sends you the draft without being asked twice.

30-second test: Search the draft DPA for “deletion” and a deadline. If there is no number, ask for one.

3. What happens when data goes to the US?

Transfers to a third country follow their own rules (Articles 44 ff. GDPR). For the US, the European Commission’s adequacy decision on the EU-US Data Privacy Framework has applied since July 2023. Under it, data can flow to US companies that participate in the framework.

The framework is under scrutiny, though. The General Court of the EU dismissed a challenge to it on 3 September 2025. The claimant appealed to the Court of Justice on 31 October 2025. Law firm WilmerHale therefore advises companies, among other things, to keep alternative transfer mechanisms such as standard contractual clauses in place.

Our view: for procurement this does not mean avoiding US services. What matters is that you know which service sends which data to the US, and that the vendor has a plan B.

30-second test: Ask: “Which data leaves the EU, and on what basis?” A good answer names the service, the type of data and the mechanism in one sentence.

4. Which security is proven, not just promised?

Article 32 GDPR requires measures appropriate to the risk. The law gives examples, including the pseudonymisation and encryption of personal data and a process for regularly testing whether the measures work.

One German benchmark is the C5 criteria catalogue of the BSI, Germany’s federal cyber security agency. It sets minimum requirements for secure cloud computing, and auditors can attest that they are met. The BSI does not evaluate the audit reports itself, so you have to read the report yourself. For smaller vendors, a certified data centre (ISO 27001, for example) plus a clear description of the vendor’s own measures is a realistic standard.

30-second test: Ask for the description of technical and organisational measures (TOMs). If it arrives as one document, the vendor is prepared.

5. Which data does the tool need to see at all?

The best data protection question comes before all the others: does the tool need this data at all? For preview and presentation tools the answer is often no. Placing a creative on an advertising space does not require uploading it to someone else’s server.

In our projects we see the review get much shorter when less data leaves the building. Every data flow that does not exist needs no line in the DPA, the sub-processor list or the privacy policy.

30-second test: Open the tool, press F12 and switch to the “Network” tab. Drop a file in and check whether it gets uploaded.

Why an in-browser preview shortens the review

The Creative Simulator places the creative on the screen directly in the browser. For the live simulation the creative file is not sent to our servers, and the export is rendered locally too. The servers are hosted by Hetzner in Germany, and a DPA under Article 28 GDPR is available on request.

What is processed where, including the platform’s optional AI features, is set out on our security and data protection page. You can forward it straight to your data protection officer.

Sources

• Art. 28 GDPR, Processor — gdpr-info.eu
• Art. 32 GDPR, Security of processing — gdpr-info.eu
• Art. 44 GDPR, General principle for transfers — gdpr-info.eu
• Art. 83 GDPR, Administrative fines — gdpr-info.eu
• EU-US data transfers — European Commission
• European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework — WilmerHale
• C5 criteria catalogue — BSI