Do personal data rules apply to a cloud provider?
Short answer
Yes as a processor under the GDPR and as an entrusted party under PIPL, with the duties written into the customer contract.
Read against the registers 2026-08-26.
Who the role is
Whoever runs infrastructure, hosting or a platform for someone else's data and traffic.
What the topic covers
The three main personal data regimes cover the same records but start from different premises. The GDPR asks for a legal basis before processing. California gives the consumer rights after the fact. PIPL asks for separate consent for named categories.
Duties the EU acts name for this role
- GDPR — Regulation (EU) 2016/679, Article 28: Process personal data only on documented instructions, under a written processor agreement.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Requires a legal basis per purpose, information to the person, and rights of access, correction and erasure.
- ePrivacy Directive — Directive 2002/58/EC: Covers terminal equipment: cookies and similar reading of a device need consent unless strictly necessary.
United States
- California Consumer Privacy Act, as amended by the CPRA: Applies above stated thresholds. Consumers can know, delete, correct and opt out of sale or sharing.
- FTC Act Section 5, unfair or deceptive practices in AI and data: Data claims in a privacy notice are enforceable as representations under Section 5.
China
- Personal Information Protection Law of the People's Republic of China: Requires a lawful ground, separate consent for sensitive categories and a named person responsible.
Where companies usually start
- List the purposes first, then the data each purpose needs, and not the other way round.
- Check which of the three regimes the same record falls under at the same time.
- Keep one written record of purposes that all three notices are generated from.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for cloud service provider
- Do ai governance rules apply to a cloud provider?
- Do cross-border data rules apply to a cloud provider?
- Do cybersecurity rules apply to a cloud provider?
- Do health data rules apply to a cloud provider?
- Do online platforms rules apply to a cloud provider?
- Do consumer rights rules apply to a cloud provider?
- Do product safety rules apply to a cloud provider?
- Do climate disclosure rules apply to a cloud provider?
- Do export controls rules apply to a cloud provider?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
