Moving data to the cloud doesn't mean losing control of GDPR compliance. Done properly, cloud actually makes data protection easier than on-premises, better tooling, audited providers, automatic encryption, finer-grained access controls. Done badly, it creates a compliance nightmare.
The 30-second version
UK GDPR (and the Data Protection Act 2018) requires you to:
- Know what personal data you hold and where it sits.
- Have a lawful basis for processing it.
- Protect it appropriately (security, access controls, encryption).
- Honour data subject requests within a month.
- Report a serious breach to the ICO within 72 hours.
- Have written contracts with any third party processing data on your behalf, including cloud providers.
Cloud doesn't change those obligations. It just changes where some data lives and who shares responsibility.
Who is responsible for what?
- You (controller): lawful basis, what data is collected, how long it's kept, who has access, responding to data subjects.
- Your cloud provider (processor): securing the underlying infrastructure, applying patches, providing controls.
Your contract with them (the Data Processing Addendum) should be signed and on file. For Microsoft 365, the DPA is part of the Microsoft Products and Services Agreement.
Data residency
UK GDPR is fine with data leaving the UK if appropriate safeguards are in place:
- EU/EEA-resident data is straightforward (adequacy).
- US-resident data is permitted under the UK-US Data Bridge.
- Other jurisdictions require Standard Contractual Clauses and a transfer risk assessment.
Practical answer: pin your data to UK or EU regions wherever the provider lets you.
What you actually need to do
1. Map your data
You can't protect what you don't know about. List what personal data you collect, where it sits, who has access, how long you keep it.
Most SMEs have at least three forgotten places personal data lives, old shared drives, ex-employees' OneDrives, marketing list exports on someone's desktop.
2. Apply technical safeguards
What "appropriate technical and organisational measures" actually means in 2026:
- MFA on every account. See our MFA setup guide. Without MFA, you do not have appropriate security on cloud accounts.
- Encryption at rest and in transit.
- Access controls based on job role. Default to least-privilege.
- Conditional access policies.
- Data Loss Prevention (DLP) policies.
- Audit logging with at least 12 months retention.
This is what makes Microsoft 365 Business Premium our default recommendation. See our cyber security service for what we deploy as standard.
3. Backup the right things
UK GDPR requires you to be able to restore availability of personal data in a timely manner. Microsoft does not back up your Microsoft 365 data. Use a proper third-party backup. See our data recovery FAQ.
4. Have a breach response plan
You have 72 hours to notify the ICO. The clock starts when you become aware, not when you've finished investigating.
You need a documented internal procedure, pre-agreed external help, templates for ICO and customer notification, and cyber insurance with breach response cover. Run a tabletop exercise once a year.
5. Train people
The most common cause of a UK GDPR breach is human error, wrong recipient on an email (see Outlook recall), losing a USB stick, falling for a phishing email.
Phishing simulations every quarter are dramatically more effective than annual training, see our guide on running fake phishing tests in Microsoft 365.
Specific cloud GDPR pitfalls
Sensitivity labels not configured
Microsoft 365 Sensitivity Labels let you classify documents and apply protections automatically. Most tenants we audit have them not configured at all.
External sharing on by default
OneDrive and SharePoint default to allowing external sharing. It should be configured deliberately.
Departed staff still have access
When someone leaves: disable account immediately, revoke sessions, transfer ownership of OneDrive/mailbox/SharePoint, remove from all SaaS apps (the bit that gets missed), document the process.
Marketing tools full of personal data
Mailchimp, HubSpot, your CRM, all hold personal data. All need a DPA, all need to be in the data map.
AI tools with no clarity on training data
The biggest area in 2026 is staff feeding personal data into ChatGPT, Copilot, Gemini. Microsoft 365 Copilot processes data within your tenant boundary and doesn't train on it. Free public ChatGPT does not give those guarantees. Get an internal AI usage policy in place.
Sub-processors
Your cloud provider uses other providers. You're allowed to use cloud providers that use sub-processors, but you should know who they are and be notified of new ones.
Practical compliance checklist
- Data map exists and reviewed annually.
- DPA signed with every cloud provider.
- UK or EU data residency where possible.
- MFA on every cloud account.
- Conditional access and least-privilege.
- DLP policies for sensitive data types.
- Third-party backup of Microsoft 365.
- Documented breach response plan, tested annually.
- Annual GDPR training + quarterly phishing simulations.
- Documented offboarding procedure.
- List of all SaaS in use, with owners and purposes.
- Privacy notice on website matches reality.
If you can't tick most of these, you have work to do. We help Birmingham businesses get to compliant cloud setups every week, usually as part of a wider cyber security and cloud support engagement.
When to bring in specialist help
For most UK SMEs, GDPR cloud compliance is technical hygiene. Bring in specialist data protection lawyers when:
- You're the controller for special category data at scale.
- Major international transfers outside standard provider regions.
- You've had a significant breach.
- Profiling, automated decision-making or large-scale monitoring.
For everyday SMEs, the practical compliance work is what matters, and it's almost entirely IT work, done well.
Get in touch for a free GDPR-aware IT health check, we'll review your cloud setup against the checklist above and give you a clear action list.