Canada: The Legal Issues Of Cloud-based Computing Services

Business leaders are under tremendous pressure to maximize the value of their company's IT and data. Staying on top of the ever-changing technology and tools available today can be daunting and give rise to complex legal issues and risks. Done well, cloud computing has the power to transform organizations, giving businesses greater competitive advantage, increasing their bottom line and shareholder value. At the very least, the use of cloud services may provide an opportunity to reduce capital costs and conceive of IT services as a variable cost or expense, in particular for new or replacement IT functionalities. Done poorly and without proper analysis and mitigation of the risks, cloud computing can be disastrous, including data corruption or unauthorized access, violations of the law, serious harm to the organization's reputation, and (although rare) potentially fines and imprisonment for directors and officers.

What would you do if you could implement safe and secure cloud-based computing services? By following the strategies discussed in this article, and obtaining legal advice from an experienced IT lawyer, you could manage your cloud services for security and efficiency, gain control of the explosively growing data that your business generates, rapidly and inexpensively provision the latest technology (such as mobile, wireless, or "big data" analytics), instantly scale infrastructure for peak performance, and deliver measurable cost savings and value to your stakeholders.

Addressing Privacy and Security Concerns

The cloud model has been highly criticized for risk of data privacy and security breaches. In Canada and many other countries throughout the world, there are numerous privacy laws at both the Federal and local (state or provincial) levels. In addition, entities in regulated industry sectors, such as financial services and health care, have specific rules and regulations governing their customers' and patients' data storage, and the communication, hosting, transfer and disclosure of related information, as well as the outsourcing of services to third parties, in particular in foreign jurisdictions. The complexity of legal compliance is sometimes overwhelming and many organizations have mistakenly assumed, or simply taken the position, that they cannot use a cloud service. However, that is not necessarily the case. For example, the Canadian federal Personal Information Protection and Electronic Documents Act (PIPEDA) does not prohibit cloud computing or cross-border data transfer by private sector entities in most industries, even when the cloud service provider (or a part of the cloud service provided) is in another country (BC and Nova Scotia public sector statutes prohibit cross-border outsourcing or cloud services unless certain exceptions apply. Numerous guidelines and public sector policies must also be followed). However, PIPEDA (and other private sector privacy laws and outsourcing guidelines) establish rules governing use of the cloud and data transfer — particularly with respect to obtaining consent for the collection, use and disclosure of personal information, notification of cross-border information transfer, securing the data, and ensuring accountability for the information and transparency in terms of practices.

By using cloud-based computing services, organizations must make sure that, before they hand over their data to a cloud service provider, their organization and the cloud service provider have structured their operations and their respective rights and obligations under their agreements such that they are legally permitted to do so, that the data will be safely maintained with access to only those people who have the appropriate legal rights, and that the organization remains in control of their data to the extent required by law. This may mean that consumer-targeted cloud services are not amenable for use by large enterprises or those with sensitive information needs, but it does not mean use of the cloud (or a variant of cloud services) is out of the question.

Legal Strategies for Successful Cloud Computing

In order to obtain successful cloud-based computing services, with the benefits of safety and security as well as legal compliance, an organization must first make an informed business decision about the type and sensitivity of data and service it plans to migrate to the cloud, specific configurations and type of cloud service required (e.g., private, hybrid or public), in order to comply with the organization's legal obligations. The enterprise must consider whether certain components of its data, information and ICT operations are compatible with data computing being resident, and control being held at least partially, outside of the enterprise. Some mission-critical and reputationally-sensitive ICT functions may not be amenable to any type of outsourcing. When ICT functions which are amenable to migration to the cloud are identified, the functions, goals, system requirements, and enterprise aspirations for those functions can be analyzed and potential cloud services and providers can be identified and examined. Prior to contracting with a particular cloud service provider the enterprise should insist upon transparency, identifying all of the parties involved (e.g., subcontractors), the data process flow, uses and locations. A detailed audit and assessment of the cloud service provider's security protocols and technology is recommended, and a roadmap of the service provider's future plans is also helpful. As well, a migration plan should be developed, including an assessment of current state architecture, applications, data and performance metrics, so that one knows what needs to be changed and to have a baseline to make future service level measurements meaningful. Similarly, a transition plan for exiting the cloud service relationship should be constructed in advance.

Second, the organization must properly negotiate and draft the legal contract between the organization and the cloud service provider. IT managers may not have the authority to agree to the terms of the contract or accept the risks. Organizations sometimes find that cloud providers, in particular the low-cost online service providers, present "take it or leave it" contracts that are non-negotiable. The risks of doing business with these cloud service providers and accepting their boilerplate contracts are that many of them:

  • lack critical enterprise-protective terms, 
  • do not adequately protect the customer's data, 
  • do not contain any guarantee as to quality of service, and 
  • allow for more liberal usage of personal information, which would not be sufficient for an organization to meet its privacy and other legal obligations.

Often, cloud service contracts fail to deal with proper transitioning of the data and services to another cloud provider (or back to the customer organization) when the contract or the relationship comes to an end, leaving the organization vulnerable to loss of, or inaccessible, data and interruption of critical services. This is why engagement of experienced IT counsel can be invaluable. Generally speaking, more industry-specific cloud offerings are available, but at costs which are higher than consumer-based or generic services that are more suitable to non-enterprise or non-regulated businesses.

A successful procurement of cloud services takes time and requires the involvement of informed and experienced legal counsel who can spot the issues and advise on whether the cloud services contract terms are adequate. If the contract terms are not acceptable and cannot be amended, the business leaders should consider finding a different cloud service provider, or maintain certain services in-house and restrict the type of data or service that will be migrated to the cloud.

Terms which need to be thoroughly covered in a cloud service contract include:

  • ownership of data,
  • termination rights and termination assistance, 
  • uptime, 
  • service availability, 
  • performance levels, 
  • security warranties, 
  • allocation of liability risk, 
  • privacy, 
  • data security and breach notification requirements, 
  • compliance with laws and regulations,
  • representations about jurisdictional exposure of information and operations, and
  • remedies for breach of the contract.

Cloud service contracts should also include proper terms dealing with:

  • change,
  • problem resolution,
  • subcontracting, 
  • use of open source software, 
  • application re-development, 
  • ownership of any intellectual property, 
  • trade-secret protection, 
  • confidentiality,
  • testing, 
  • data integrity, 
  • potential secondary uses of data,
  • assurance of data segregation and isolation, 
  • encryption in transit and in storage, 
  • backup and data recovery, 
  • what happens to the data and the infrastructure upon termination of the agreement or in the event of a failure or insolvency of one of the parties, 
  • how maintenance or service interruption will be handled, 
  • what geographical limitations must be imposed, 
  • the right to audit the entities and the technology, etc.

The foregoing is not an all inclusive list. Each cloud service needs to be looked at separately and carefully analyzed to determine the full extent of the business and legal risks, before your legal counsel can advise on what contract terms are appropriate and which ones need to be revised.

The third step to achieve success with cloud-based computing is to implement appropriate internal organizational and transitional governance, policies and controls. Business processes and operations may need to be realigned. Monitoring and reporting structures up to senior management and Board levels need to be implemented. Policies dealing with confidentiality, security, privacy, business continuity plans, ongoing risk identification and management, technical problem escalation, and electronic data retention need to be prepared or revised as well as disseminated, clarified and enforced throughout the organization. Data cleansing, encryption and backup activities may need to be incorporated into the organization's business processes. Employee policies should also be developed or modified to deal with employee use of cloud-based services (in particular when accessed via their own personal devices for business purposes), such as e-mail for business correspondence, customer database/sales management, document sharing or presentations, etc. Business leaders need to remember that they are accountable for their organization's use and outsourcing of data or other services to a cloud provider and must ensure that their organization's information management and privacy practices are compliant with the law and consistently applied across the organization at all levels.

Cloud-based computing can have numerous advantages and be accomplished successfully if all the legal considerations are taken into account. Failing to take the appropriate steps or rushing through to secure a cloud deal without thorough legal review, can have a large negative impact to the business and its stakeholders.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
Collins Barrow National Incorporated
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Collins Barrow National Incorporated
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
Email Address
Company Name
Confirm Password
Mondaq Topics -- Select your Interests
 Law Performance
 Law Practice
 Media & IT
 Real Estate
 Wealth Mgt
Asia Pacific
European Union
Latin America
Middle East
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of

To Use you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions