Acquisition

This SME is a small start-up but is envisioning to be number 1 in its market, globally. It will need cloud service to do so, and as per different technical, business, risk mitigation and risk reasons it is working on architecting a hybrid ecosystem where several major as well as niche CSPs will be involved. However, all CSPs define their definitions and legal terms differently which makes it hard to create a clear landscape of what rights and obligation the SME has towards the respective CSP, and what rights and obligations it can arrange for with its own customers and end-users.

This SME is migrating its infrastructure to IaaS of a major CSP. Being a software company itself does not necessarily mean to have the necessary knowledge for migrating to the SaaS. And, to start with, in order to provide a good proposal and business model based on subscription fees this SME needs to know what kind of different duration period are applicable, and what the financial, technical and operational consequences are.

As per an above-average awareness level as per security breaches in its sector, being the financial services industry, this SME is quite concerned about keeping its data safe while also complying to current and upcoming regulation. With all the topics in the newspapers on security incidents, every SME should be keen on the management of those incidents, and this SME actually does. Besides that, new regulations such as the General Data Protection Regulation (GDPR) and the Network Information Security (NIS) Directive with daunting high penalties are a trigger as well.

Since both within the European Union and outside the EU each country has different laws and regulations regarding personal data protection, the data location where the SME is active is relevant as well as the data location of the server of the CSP. In this case it concerns an SME active in a dozen countries and wishes to migrate to cloud services its HR data which concerns almost 100% personal data. In some jurisdictions, such HR data is even especially arranged in the law.

The case is simple, and will happen to all CSCs: an SME wished to terminate the MSA with a CSP, and then starts thinking about whether and to what extent the CSP will delete its data, after the SME has extracted and exported that data as much as possible. This SME, as will others, finds out that nothing is arranged for, and is left in the dark.

An SME in the Health Sector who has built its SaaS application on an IaaS/PaaS from the CSP. Anyone in the health sector has to be compliant to mandatory sectorial standards and needs to have certain certifications. Furthermore, since this SME will process sensitive personal data, it also needs to encrypt the data in light of the applicable personal protection regulations in the EU.

The Choice of law clause is a term of a contract in which parties specify that any dispute arising under the SLA shall be governed by in accordance with the laws of a particular jurisdiction. Since most of the major CSPs have headquarters in the United States of Americas, many of these CSP’s have designated the governing law of the state they have their headquarters applicable to the agreement. The SME has done diligence on what CSP would fit its SaaS and business ambitions best with regard to the provided IaaS. However, it did not notice the choice of law the SLA is governed by.

As there is so much to think about while choosing, selecting and procuring cloud services, and the SME is aware that carve-outs are part of the cloud SLA where the CSP further limits or excludes its responsibility and liability, it is not always the highest priority to assess, understand, discuss and negotiate these with the CSP. When an incident happens the CSP has defined the carve-out ‘force majeure’ very broad, in a way that all influences of third parties are excluded, even of those the CSP procures to be able to provide the cloud services.

The organisation decided to see how practical it would be to run the payroll process in the cloud. The existing payroll system was architected as a distributed application, so moving it to the cloud was relatively straightforward. The payroll application used an SQL database for processing employee data. Instead of rewriting the application to use a cloud database service, a VM with a database server was deployed. The database server retrieved data from a cloud storage system and constructed relational tables from it.

An online retailer needs to develop a new Web 2.0 storefront application, but does not want to burden its IT sta  and existing resources. The company chooses a cloud provider to deliver a cloud-based development environment with hosted developer tooling and a source code repository. Another cloud provider is chosen to provide a testing environment so that the new application can interact with many di different types of machines and huge workloads.