GDPR and data protection for SMEs using AI

Introduction

Quick answer (actionable summary): It is not advisable for an SME to depend 100% on a cloud provider without complementary controls. Retaining some local control, clear contractual terms, strong encryption and an exit strategy reduces legal and operational risks.

This article explains, in practical terms, why exclusive reliance on the cloud is risky, the key GDPR obligations affecting your SME, real operational threats, technical and contractual measures you can implement now, concrete examples and an actionable checklist to start an internal audit.

Quick answer: should an SME avoid relying 100% on the cloud?

Practical summary: Using cloud services is not forbidden, but relying solely on them without controls exposes your SME to legal risk, continuity issues and loss of control over data. Five key reasons:

Contractual obligations and liability (FACT): under the GDPR the controller‑processor relationship must be written and contain minimum clauses; the SME remains responsible to data subjects and authorities even when using cloud services. (See Art.28 GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es)
International transfers and foreign authorities’ access (FACT / SOURCES): the Schrems II judgment invalidated the previous framework (Privacy Shield) and requires assessing transfer risks; the current framework is the EU‑US Data Privacy Framework, which is subject to periodic review (official links below).
Loss of control over keys and data (INFERENCE): if the provider manages encryption keys, the SME may be unable to prevent third‑party access or recover data outside the provider.
Vendor lock‑in and portability (INFERENCE): technical difficulty and cost to migrate data and services may prevent a swift exit if problems arise with the provider.
Operational continuity and outages (INFERENCE): service interruptions or commercial changes (price rises, limits) can halt critical processes if you have no recovery plan.

Evidence to review: relevant legal texts (GDPR/LOPDGDD), EDPB/AEPD guidance and your provider’s contractual documents (SLA, security policies, exit clauses).

Key legal obligations for SMEs using cloud services

Note on categories: below I indicate whether each statement is FACT (normative/jurisprudence cited), INFERENCE (reasonable conclusion from the law) or RECOMMENDATION (practical advice). Whenever I cite a GDPR article I link to the consolidated text on EUR‑Lex.

Contract with the provider: Art.28 GDPR (processor)

FACT: Article 28 GDPR requires the controller‑processor relationship to be governed by a contract or binding legal act that binds the processor (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es). The contract must establish, among other things:

Subject matter and duration of processing.
Nature and purpose of the processing.
Types of personal data and categories of data subjects.
Documented instructions from the controller to the processor.
Guarantees of appropriate technical and organisational measures.
Conditions for sub‑processing (subprocessors).
Obligation to assist the controller (e.g. breach notification, rights fulfilment).
Return or deletion of data at contract end.

RECOMMENDATION: minimum clauses (practical outline)

Scope clause: clear definition of processing and data.
Security: list of measures (encryption, IAM, backups, etc.) and reference to Art.32.
Subprocessors: prior authorisation, list and notification duty.
Audit: right to audit or proof of compliance (SSAE/SOC reports) and timing.
Portability / exit: export format and delivery times.
Liability and penalties for contractual breach.

RECOMMENDATION: always seek legal review of contracts; Art.28 is a baseline but clauses must fit the actual risk of your processing.

Records of processing activities (Art.30) and documentation duties

FACT: Art.30 GDPR requires keeping records of processing activities except for certain exemptions (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es). SMEs with fewer than 250 employees may be exempt unless processing is not occasional, poses risks to rights and freedoms, involves special categories of data, or relates to criminal convictions.

RECOMMENDATION: even if not mandatory due to size, keep a minimal record (what data you process, purpose, legal basis, third parties, retention periods). This helps incident response and shows diligence to the AEPD.

Practical sources: EDPB and AEPD templates and guides: EDPB (https://edpb.europa.eu/home_es) and AEPD (https://www.aepd.es/es/guias-y-herramientas).

Breach notification (Art.33) and operational responsibilities

FACT: Art.33 requires that a personal data breach be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es).

Operational recommendation: define who detects breaches, the escalation process, notification templates and who will liaise with the cloud provider. The provider contract should set notification times and responsibilities between parties.

Security measures (Art.32) and proportionality

FACT: Art.32 requires appropriate technical and organisational measures, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es). Examples include encryption and the ability to restore availability.

TECHNICAL RECOMMENDATION: apply proportionate measures: encryption in transit and at rest, access controls (IAM), logging and monitoring, patch management, restoration testing and segregated backups. ENISA publishes cloud security guidance to support implementation (https://www.enisa.europa.eu/).

DPIA (Data Protection Impact Assessment) — when it is required (Art.35)

FACT: Art.35 governs DPIAs where processing, especially using new technologies or systematic evaluation of personal aspects, is likely to result in high risk to individuals’ rights and freedoms (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es).

INFERENCE / RECOMMENDATION: typical cases requiring DPIA include large‑scale processing of special categories, systematic surveillance, automated profiling with significant effects or use of AI for automated decision‑making. Use EDPB/AEPD templates for procedure and criteria: EDPB (https://edpb.europa.eu/home_es) and AEPD (https://www.aepd.es/es/guias-y-herramientas).

International data transfers: past, present and future

This section is time‑sensitive. Below is a chronological summary and what it means for SMEs.

Historical context (PAST) — why Schrems II matters

FACT: The Schrems II judgment (C‑311/18) of the Court of Justice of the European Union impacted international transfer frameworks, questioning the protection afforded by mechanisms such as Privacy Shield. Official judgment (EUR‑Lex): https://eur-lex.europa.eu/legal-content/ES/TXT/PDF/?uri=CELEX:62018CA0311&from=ES

Current situation (PRESENT) — transfer frameworks and best practice

FACT: In July 2023 the European Commission adopted an adequacy decision for the EU‑US Data Privacy Framework, replacing the Privacy Shield invalidated by Schrems II. Commission press release: https://ec.europa.eu/commission/presscorner/detail/en/ip233721. This decision is subject to periodic review; always check the Commission’s adequacy decisions page for current status: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

Practical recommendations for transfers:

Carry out a Transfer Impact Assessment (TIA) before transferring: document data routes, jurisdictions involved and technical/contractual measures.
Use the Commission’s standard contractual clauses where applicable and add supplementary measures (encryption, key control, segregation).
Consult EDPB/AEPD guidance on transfers and supplementary measures: EDPB (https://edpb.europa.eu/home_es) and AEPD (https://www.aepd.es/).

Future risks and signals to monitor (FUTURE)

FACT: The EU AI Act (Regulation (EU) 2024/1689) is in force and its obligations are phased in until 2027; it may add documentation, transparency and assessment duties where AI models process personal data. Consolidated text (EUR‑Lex): https://eur-lex.europa.eu/legal-content/ES/TXT/?uri=CELEX%3A32024R1689

RECOMMENDATION / FORECAST: because the AI Act’s timeline is progressive, review periodically which obligations already apply to your specific use cases on the official page linked above.

Table: PAST — PRESENT — FUTURE (chronological summary and practical effects)

Period	What happened / legal status	What SMEs should do (practical action)
PAST	GDPR adopted (Regulation (EU) 2016/679) and Spain’s LOPDGDD enacted; Schrems II (C‑311/18) invalidated Privacy Shield.	Ground contracts on Art.28, keep records per Art.30 and design breach notification processes (Art.33).
PRESENT	GDPR and LOPDGDD in force; EDPB/AEPD guidance and ENISA recommendations available; EU‑US Data Privacy Framework (July 2023) is the current mechanism for US transfers, subject to review.	Perform Transfer Impact Assessments, require standard contractual clauses, encryption and key control; document DPIA if applicable.
FUTURE	AI Act (Regulation (EU) 2024/1689) is being phased in to 2027 with new documentation and transparency duties for AI systems.	Keep a policy of periodic review (eg every 6–12 months) of providers, contracts and transfers; include a regulatory‑review clause in contracts.

Real operational risks from relying 100% on the cloud

INFERENCE: The operational risks are real and should be addressed practically:

Vendor lock‑in: technical and cost barriers to migrate data and services.
Outages and interruptions: impact on availability of critical services.
Variable costs: growing usage can increase bills if not controlled (eg egress, API calls).
Loss of control over keys and access: without key control you depend on the provider to access your data.
Insufficient governance: lack of data inventory and processes that hinder inspection or breach response.

Quick comparative snapshot:

Pure cloud: fast deployment, scalability; higher lock‑in risk and third‑party dependence.
Hybrid: sensitive data on‑premise or in a private cloud, functional loads on public cloud; better control, higher complexity and initial cost.
Multi‑cloud: reduces single‑provider dependence and improves resilience; requires orchestration and skills.

RECOMMENDATION: choice depends on data type, resources and technical capability. For most SMEs a hybrid or multi‑cloud approach with clear policies balances cost and risk.

Recommended technical and organisational measures to meet the GDPR and lower risk

Based on Art.32 (FACT) and ENISA/EDPB guidance (https://www.enisa.europa.eu/ and https://edpb.europa.eu/home_es), practical measures include:

Encryption in transit and at rest; document who controls keys.
Access management (IAM): least privilege and strong authentication.
Centralised logging and monitoring; documented retention.
Backups outside the primary provider and regular restore tests.
Segmentation/environments (production/development/test).
Policies and staff training on data handling and incident response.

Encryption and key management: good practice

INFERENCE / RECOMMENDATION: distinguish provider‑managed keys from customer‑managed keys (Customer‑Managed Keys, CMK):

Provider‑managed keys: lower operational complexity but less control.
Customer‑managed keys (external KMS or on‑premise): more control and protection against unwanted access, but greater operational responsibility.

Contractual recommendation: document who controls keys, rotation procedures and what happens to keys when the service ends.

Backups, continuity and recovery testing

Practical recommendation for SMEs (indicative/illustrative):

Minimum orientative policy: daily backups for critical data and a full weekly backup; keep copies for at least 30 days. This is illustrative and should be adjusted by sector and risk.
Keep at least one backup copy with a different provider or locally/outside the primary provider.
Perform restore tests at least every six months (or quarterly for critical data) and document your Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

If you would like us to set this up with you, we can support the architecture phase of the Momentum Process and adapt these measures to your situation.

(Intermediate CTA: we offer assistance in architecture and recovery testing; we do not promise specific results or legal guarantees.)

Contractual and governance strategies for responsible cloud dependence

Contract checklist (clauses to require)

Service scope and data processed (clear definition).
SLA with availability metrics and penalties.
Data exit/portability procedures (formats, timescales, costs).
Conditions for subcontracting and list of subprocessors.
Breach notification obligations and cooperation in investigations.
Right to audit or third‑party reports (SSAE/SOC).
Processing location and transfer policy.
Key control and encryption responsibilities: clause specifying duties.

RECOMMENDATION: obtain an independent audit if you handle large volumes of sensitive data or if a provider refuses reasonable clauses.

AI and cloud cognitive services: specific risks and recommendations

FACT / INFERENCE: AI use increases risks from training on data, traceability of automated decisions and explainability challenges. EDPB and national authorities ask for special care when AI leads to profiling or decisions affecting rights (EDPB: https://edpb.europa.eu/home_es).

Practical recommendation:

Assess whether the use case requires a DPIA.
Document the model’s purpose, training data, bias mitigation measures and inference logs.
Minimise and anonymise training data where possible; if not possible, document the legal basis.

Short DPIA checklist for AI projects (illustrative)

Describe the project and purpose.
Identify data categories and approximate volume.
Assess risk to rights and freedoms (high/medium/low).
List technical and organisational mitigation measures.
Decide whether to consult a DPO or the supervisory authority.

(Use EDPB/AEPD templates where appropriate: EDPB https://edpb.europa.eu/home_es ; AEPD https://www.aepd.es/es/guias-y-herramientas)

Recommended architectures for SMEs: practical comparison (on‑premise / hybrid / multi‑cloud)

Practical summary:

On‑premise: maximum sovereignty, higher initial cost and maintenance. Recommended if you handle extremely sensitive data and have technical resources.
Hybrid: recommended for many SMEs: sensitive workloads on‑premise or private cloud; scalable apps on public cloud.
Multi‑cloud: good for resilience and avoiding lock‑in for critical services; requires investment in orchestration and skills.

Illustrative example: a dental clinic with five surgeries (case example)

Clinical records: stored on a local server in the clinic (on‑premise) with encrypted backups replicated to a second EU‑based provider.
Appointments and reminders: public cloud service with Art.28 clauses and key management retained by the clinic.
Recovery targets: illustrative RTO 4 hours for appointments and RTO 24 hours for clinical records. These are indicative and must be adapted to your needs.

Practical step‑by‑step checklist to audit and reduce cloud dependence

Copy and adapt this checklist to your organisation.

Map and classify data: who are the data subjects, data categories and sensitivity. Owner: compliance/IT. Priority: high.
Inventory providers: list cloud services, functions, data processed and processing countries. Owner: IT/admin. Priority: high.
Review current contracts: check Art.28 clauses, subprocessors, SLA and exit clauses. Owner: legal/DPO. Priority: high.
Assess transfers: identify flows outside the EU and perform a Transfer Impact Assessment. Owner: legal/IT. Priority: high.
Decide what must remain under local control (sensitive data). Owner: management. Priority: medium‑high.
Implement encryption and document key control (KMS). Owner: IT. Priority: high.
Set external backups and test recovery (RTO/RPO). Owner: IT. Priority: high.
Deploy IAM and multi‑factor authentication. Owner: IT. Priority: medium.
Define breach notification process and templates. Owner: DPO/management. Priority: high.
Conduct a DPIA if applicable (AI, profiling, special categories). Owner: DPO/external consultant. Priority: risk‑based.
Staff training on data handling and policies. Owner: HR/DPO. Priority: medium.
Periodic review (every 6–12 months) of contracts and provider assessments. Owner: management/DPO. Priority: medium.
Keep evidence for audits (records, restore tests, audit reports). Owner: DPO/IT. Priority: high.

Resources, templates and official links

Consolidated GDPR text (EUR‑Lex): https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es
LOPDGDD (BOE): https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673
Schrems II judgment, C‑311/18 (EUR‑Lex): https://eur-lex.europa.eu/legal-content/ES/TXT/PDF/?uri=CELEX:62018CA0311&from=ES
EU‑US Data Privacy Framework adequacy decision (European Commission): https://ec.europa.eu/commission/presscorner/detail/en/ip233721
AI Act, Regulation (EU) 2024/1689 (EUR‑Lex): https://eur-lex.europa.eu/legal-content/ES/TXT/?uri=CELEX%3A32024R1689
EDPB (guidelines and templates): https://edpb.europa.eu/home_es
AEPD (guides and tools): https://www.aepd.es/es/guias-y-herramientas
ENISA (technical cloud security guidance): https://www.enisa.europa.eu/

Frequently asked questions (selected)

Is the cloud forbidden by the GDPR?

Answer: No (FACT). The GDPR does not ban cloud use; it requires the controller‑processor relationship to be documented and appropriate security measures to be adopted (Art.28, Art.32). The SME remains responsible towards data subjects and authorities.

What should a contract with a cloud provider include under the GDPR?

Short answer: Art.28 minimum clauses: subject and duration, documented instructions, security measures, subprocessors, assistance to the controller and return or deletion of data at termination. See Art.28 (https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=es) and seek legal review.

When does my SME need a DPIA for AI services in the cloud?

If AI processing involves large‑scale evaluation, automated decisions with significant effects, or special categories of data, a DPIA is likely required (Art.35). Use EDPB/AEPD templates and consult advice if unsure.

Is the EU‑US Data Privacy Framework sufficient for transfers to the US?

Answer: Yes, it is the mechanism in force since July 2023 for transfers to US companies that adhere to it, but it is subject to review and potential legal challenge (as happened with Privacy Shield). Always check the Commission’s adequacy decisions page: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

What technical measures are essential to protect personal data in the cloud?

Minimum recommended measures (Art.32): encryption in transit and at rest, identity and access management, backups and restore testing, monitoring and subprocessors control. ENISA publishes best practice guidance (https://www.enisa.europa.eu/).

Conclusion and next steps (recommended action)

Key idea: Using the cloud is compatible with the GDPR, but relying solely on it without controls increases legal and operational risk. Three priority actions to start:

Audit and classify data: identify which data is sensitive and which must remain under your control.
Review contracts and key management: require Art.28 clauses and decide whether you will control keys (KMS).
Continuity plan and DPIA: set external backups, define RTO/RPO and carry out a DPIA where AI or other high‑risk processing is used.

If you would like us to assess your specific case and recommend a prioritized starting plan, request a Free Assessment; in it we will review your situation, identify transfer risks and propose a realistic plan to reduce cloud dependence without paralysing your operations.

This article was drafted with the support of artificial intelligence and reviewed by qualified Momentum Logic AI staff before publication.

Momentum Logic AI Team . momentumlogicai.es . LinkedIn