<p>For many companies the business case is compelling. As with any  business decision, it is important to be fully informed, and aware of  the risks.&nbsp; In this article, the first in a series of two, we look at  some of the core legal considerations associated with cloud computing.<br /><br /><strong>Information</strong><br /><br />As  one might expect, issues relating to information are central to legal  considerations associated with cloud computing. Many of the  information-related issues that arise are closely inter-related. By  signing-on with a Cloud Service Provider, and moving data to the CSP&rsquo;s  cloud, the CSP&rsquo;s client is no longer in direct control of the data.&nbsp;  Depending on the nature of the cloud (public, private or &lsquo;hybrid&rsquo;), the  potential vulnerability of the data may vary. In some instances, where  the CSP uses infrastructure located abroad, data is sent outside the  client&rsquo;s country. When data comprises personal data (such as information  relating to the client&rsquo;s customers or employees), the client needs to  be particularly aware of its obligations with regard to data protection.  In the UAE, the processing of personal data may be subject to the Penal  Code prohibition on the disclosure of &lsquo;secrets&rsquo; without the consent of  the person to whom the secret relates. Other laws may also be applicable  where the personal data involves health insurance, medical records, and  credit information. For entities in the Dubai international Financial  Centre and Dubai Health Care City, specific European-style data  protection regulations also impact on the processing of personal  information and sensitive personal information, including with regard to  whether permission is required to transfer the data to another  jurisdiction.&nbsp;<br /><br />Before signing on with a CSP, the client should  familiarize itself with the legal obligations relating to its handling  of personal data. When negotiating the terms of service, the client  should ensure that the agreement does not permit the CSP to engage in  any conduct that would be inconsistent with the client&rsquo;s own obligations  in respect of personal data. The client should also consider whether  there might be any practical aspects of its privacy obligations that the  CSP&rsquo;s system would need to accommodate. (By way of example, in some  jurisdictions, compliance with data protection regulations may require  the ability to annotate records to reflect objections raised by the data  subject. If the CSP&rsquo;s system cannot facilitate this requirement, this  may result in the client failing to comply with its legal obligations.)<br /><br />Security  of information is another important consideration. ISO 27001 is a  standard that details requirements for establishing, implementing,  operating, monitoring, reviewing, maintaining and improving an  information security management system. It acts to formalize specific  criteria for a range of IT security-related processes, including:  information classification and handling; third-party access; incident  management and communication; disposal of media; hiring, discipline and  termination of staff; acceptable use of computer equipment; development  processes; release and change management; and data access, availability  and integrity. As part of its due diligence, a client should aim to  engage CSPs that can show they are compliant with ISO27001. This  certification illustrates that the CSP has implemented a wide range of  security and privacy controls at all levels of its business and that all  its employees have been educated in relevant security and privacy  issues. The client should seek to build compliance with ISO27001 into  the terms of service as a means of ensuring that the CSP will treat  information security with the level of attention it requires.&nbsp;<br /><br />Rules  governing document retention are another point to bear in mind when  considering a move to the cloud. In the UAE, the Commercial Transactions  Law (Federal Law No. 18 of 1993) sets out general requirements for the  retention of commercial records, requiring that such records be retained  for a minimum period of five years from the date of issue or receipt.  With limited exceptions, the Electronic Commerce and Transactions Law  (Federal Law No. 1 of 2006) provides that, where it is required by law  to retain a certain document, record or information for any reason  whatsoever, the retention requirement shall be considered met if the  document, record or information is stored in any electronic form. When  engaging a CSP to manage commercial records, the client should focus on  making sure that the terms relating to the document retention period are  consistent with the requirements of the client&rsquo;s own jurisdiction &ndash; and  not with those of the CSP.&nbsp;<br /><br />In some instances, CSPs may  consolidate the data of multiple clients in order to determine data  usage patterns, business trends and strategies. If this type of use is  undesirable, then the client should seek to have the terms of service  prohibit the CSP from monitoring data usage and from using such  &lsquo;confidential information&rsquo; of the client other than for the purpose of  providing the cloud service to the client. (Such a restriction would, of  course, be additional to any broader confidentiality provisions that  should be specified in the agreement with the CSP.)<br /><br />A further  consideration relates to the location of the client&rsquo;s data when it is  held in the cloud. In many jurisdictions, the government can require  CSPs to disclose client data. In some jurisdictions, the law  specifically protects data stored in the cloud from access by the  government without due process. In other jurisdictions data stored in  the cloud may be disclosed to governmental authorities without due  process. Depending on the nature of the data, and the business of the  client, it may be advisable to confirm with the CSP the location in  which data will be held, and verify independently whether there are any  local law concerns in such jurisdiction. It may also be appropriate to  agree with the CSP that data will not be held in certain jurisdictions.<br /><br />Al  Tamimi &amp; Company&rsquo;s Technology, Media &amp; Telecommunications team  regularly advises on IT service agreements, including in a cloud  context, as well as related issues such as data protection, document  retention and confidentiality provisions. For further information,  please contact David Yates<a href="mailto:d.yates@tamimi.com">d.yates@tamimi.com</a>&nbsp;or Nick O&rsquo;Connell&nbsp;<a href="mailto:n.oconnell@tamimi.com">n.oconnell@tamimi.com</a>.&nbsp;</p>