Cloud services agreements and the clauses that protect your data in the cloud

When the provider sends you its terms

Your business has signed up for a cloud service: a customer relationship management platform, an accounting system, file storage, or infrastructure from a provider like Google, Microsoft, Amazon Web Services, Xero or a smaller specialist. The next email contains the vendor's standard form agreement, and you are asked to accept it by clicking through or by signing. It runs to dozens of pages of defined terms, service descriptions and schedules, and the click or signature commits your business.

That document decides more than the monthly price. It decides who controls the data you store with the provider: who can access it, who can use it, what the provider must do if something goes wrong, and what happens to the data if the relationship ends. It also sits alongside your obligations under the Privacy Act 1988 (Cth). Depending on how it is drafted, it can determine whether your business is still treated as holding personal information for privacy law purposes, and therefore whether a breach at the provider's end becomes your notifiable data breach.

The clauses that decide who controls your data

There is no single legal rule that data automatically belongs to whoever created it. Copyright can protect original works such as software and carefully structured databases, but raw customer and business data is usually protected, if at all, by the contract. That is why the agreement matters so much: it is the document that actually defines who may use, access and control your data. The clauses below are the ones to read closely.

Who owns the data, and who may use it

Most agreements state that the data you upload remains yours, and that the provider receives only a licence to use it to the extent needed to run the service. The drafting choice that matters is the width of that licence. Watch for:

• Provider's own benefit: a licence that lets the provider use your data for product improvement, analytics, or training its own models goes well beyond providing the service to you.
• De-identified data: a right to use or sell aggregated or de-identified data for the provider's commercial purposes is common, and it is easy to miss.
• Feedback and suggestions: clauses that assign to the provider any rights in improvements or suggestions you make about the service.

If the licence is broad, decide whether the trade-off is acceptable or whether the provider should be limited to handling your data only for the purposes of delivering the service to you.

Confidentiality and its carve-outs

You want the provider to be bound to keep your data confidential. The clause will contain carve-outs, and those are where the protection can leak away. Standard carve-outs cover disclosure required by law, responses to government requests, and disclosure to professional advisers. The trap is a carve-out drafted so widely that it covers almost anything the provider wants to do. In particular, check whether the provider must notify you before responding to a government request or subpoena, to the extent the law allows it. That early warning is often the only reason you find out about a demand at all.

Security warranties and the uptime promise

Providers routinely warrant a percentage of uptime, so that you can access the service that proportion of the time. What they are usually less willing to warrant is the security of your data. Expect the agreement to disclaim warranties that the data is safe from alteration, loss or unauthorised access, and to cap liability accordingly. At a minimum you should be looking for:

• A security warranty: a promise that your data will be protected by security measures consistent with industry practice, or with a specified standard.
• Incident notification: a promise that the provider will tell you promptly if your data is lost or accessed without authorisation.
• Independent certification: evidence such as an ISO/IEC 27001 certificate or a SOC 2 report, which indicates the provider's security is independently audited.

This matters beyond the contract. If the data includes personal information, your business must take reasonable steps to protect it from misuse, interference, loss and unauthorised access or disclosure under APP 11 of the Privacy Act. You cannot contract out of that obligation, and the provider's promises are a large part of how you satisfy it.

Where the data lives: cross-border storage

The agreement should say which regions or countries your data may be stored in. Many providers store data "in Australia or overseas" or reserve the right to move it. That matters for two reasons.

First, APP 8 requires an APP entity to take reasonable steps, before disclosing personal information to an overseas recipient, to ensure the recipient does not breach the Australian Privacy Principles, and the disclosing entity is accountable for the recipient's handling of the information. Second, the OAIC recognises a useful distinction: providing personal information to an overseas cloud provider for the limited purpose of storage may be a "use" rather than a "disclosure" where the contract:

• requires the provider to handle the information only for limited purposes;
• requires any subcontractors to agree to the same obligations; and
• gives your business effective control, including the right to access, retrieve and permanently delete the information.

If the arrangement meets those tests, APP 8's overseas disclosure requirements do not apply. If it does not, and your data crosses the border, you may need to rely on an exception such as informed consent, which is impractical for existing customers. The drafting of the storage clause is therefore part of your privacy compliance, not just a logistical detail.

Subprocessors and other third parties

The provider will usually want the right to engage subprocessors, and the agreement should limit how far your data can be passed on. Look for a commitment that your data will only be disclosed to third parties who are bound to protect it to the same standard. The trap is a clause that lets the provider add or change subprocessors without notice, so that your data can end up with a party you have never heard of. Ask for advance notice of any new subprocessor and a right to object.

Access, export and return of your data

Even though the data is yours, the provider holds it, and your ability to get it back depends entirely on the contract. Make sure the terms set out a clear right to access your data and to receive a copy in a portable format. Ask the questions the boilerplate usually leaves open:

• Can you export the data only on request, or at set points during the term?
• Does the right survive termination of the agreement?
• If so, for how long, and is there a fee?
• What format will the data be provided in, and how long will the export take?

For a business that relies on the data to operate, the answers to these questions are more important than the monthly fee.

Deletion after the relationship ends

The agreement should promise that the provider will destroy your data within a specified period after termination. Two traps are common. The first is that "deletion" applies only to active copies, with backups retained for extended periods. The second is that there is no obligation to confirm deletion. Look for a commitment to delete all copies including backups, within a defined period, and to provide written confirmation on request. If your industry has retention obligations, make sure the clause allows you to extract what you must keep before the destruction happens.

Breach notification and the Notifiable Data Breaches scheme

The most important clause for privacy purposes is the provider's promise to notify you promptly of any security incident affecting your data. The notification needs to come quickly enough for your business to run its own assessment within the timeframes the law allows.

Under Part IIIC of the Privacy Act, an eligible data breach arises where there is unauthorised access to or unauthorised disclosure of personal information, or a loss of it, that is likely to result in serious harm to an individual, where remedial action has not prevented that risk. Whether serious harm is likely is judged from the perspective of a reasonable person in the entity's position, and "likely" means more probable than not. Where there are reasonable grounds to suspect an eligible data breach, the entity must carry out a reasonable and expeditious assessment, taking all reasonable steps to complete it within 30 calendar days. If the assessment confirms an eligible data breach, the entity must notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, with a statement describing the breach, the kinds of information involved and recommended steps for individuals.

These obligations apply to APP entities: broadly, businesses and not-for-profits with an annual turnover above $3 million, plus health service providers and certain others regardless of size. Two cloud-specific points follow. First, the OAIC takes the view that a cloud provider with possession of your records holds that personal information jointly with you, so both of you may carry notification obligations; the agreement should say who notifies whom and who leads. Second, if you disclose personal information to an overseas provider in line with APP 8, you are deemed to hold that information for the purposes of the scheme, so a breach at the overseas provider can become your notifiable data breach.

Liability, caps and indemnities

Providers limit their liability in two ways: a cap on total liability, and an exclusion of consequential loss. Both are negotiable in principle. The trap is a cap set far below what a data incident actually costs, which includes forensic investigation, notification, credit monitoring for affected individuals, remediation and reputational damage. Consider asking the provider to indemnify you against loss caused by its breach of the security or confidentiality obligations, and check that the cap covers that indemnity rather than swallowing it.

Changes to the terms

Standard form agreements often let the provider vary the terms on notice. Check how much notice is required, whether material changes allow you to exit without penalty, and whether changes can be made to the security or data handling obligations at all. A right to walk away on a material change is the practical protection if the provider later rewrites the terms against you.

Clauses worth asking for when the stakes are higher

Depending on what your data contains and how critical the service is, these optional clauses can be worth pushing for:

• Audit and assurance rights: worth including where you hold sensitive or regulated data, such as health or financial information, or where you have promised security to your own customers.
• Business continuity and disaster recovery commitments: worth including where the service is essential to day to day operations and an outage is not acceptable.
• Insurance requirements: worth including where the cost of a serious breach would far exceed the provider's liability cap.
• A data processing addendum: worth including where you are an APP entity disclosing personal information; the OAIC expects enforceable contractual arrangements requiring the recipient to comply with the Australian Privacy Principles, flowing the same obligations to subcontractors, and covering breach response and complaint handling.
• Survival of data obligations: worth including so that the return and deletion obligations survive termination of the agreement.

How an Artificer Legal lawyer would negotiate this agreement

A lawyer reviewing this document would start by mapping the clauses above against your obligations under the Privacy Act, because the agreement is the mechanism through which you discharge parts of APP 8 and APP 11. The negotiation order matters. Security warranties and breach notification should come first, because they determine whether you hear about an incident in time to comply with the Notifiable Data Breaches scheme. Data return and deletion come second, because they decide whether you can leave the provider at all. Liability and indemnities come third, because they decide who pays when something goes wrong.

There is also a statutory backstop worth knowing about. Where the agreement is a standard form contract, the unfair contract terms protections shield consumers and small businesses from unfair terms, and the party that prepared the contract must prove it is not standard form. Since 9 November 2023, proposing, using or relying on an unfair term is banned and penalties apply. In deciding whether a term is unfair, the court looks at the contract as a whole and whether the term is transparent. A clause you could not negotiate away, such as a right to delete your data without notice or an unlimited licence over your data, may be challengeable even though you had no choice but to accept it. An Artificer Legal practitioner can assess which of the provider's terms are vulnerable and advise on your options, including whether a complaint or regulator action is worthwhile.

The exit terms decide who wins if the relationship fails

The clauses most businesses skip are the ones that deal with leaving: what happens to your data when the agreement ends. Price and uptime get negotiated at signing, but the exit terms sit in the schedules and the definitions, and they decide who actually holds the power when the relationship sours. If the provider can retain your data, charge heavily for its return, or delete it without confirmation, then the commercial balance of the whole agreement shifts. The exit provisions, more than any other drafting choice, determine whether the document protects your data or merely protects the provider from you.

The rest of the agreement matters in support of that. Ownership and licence clauses decide who may use the data, security warranties and breach notification decide whether you hear about incidents in time, cross-border and subprocessor clauses decide where the data travels, and liability terms decide who pays when it all goes wrong. Review the agreement against those questions before you sign, and if the provider's standard terms will not give you the answers, ask for better ones or look for a provider that will.