37 ms·
UNSW publishes detailed cloud/data sovereignty toolkit
- contingencies 13y agoOriginal paper @ http://www.cyberlawcentre.org/data_sovereignty/CLOUD_DataSovReoprt_Full.pdf http://www.cyberlawcentre.org/data_sovereignty/CLOUD_DataSov... IMHO, this is mostly waffle. It makes the reasonable point that you should be wary of cloud provider's terms of service and their legal jurisdiction. Beyond this, it does not seem to offer any solutions. The primary driver of analyzing the legal jurisdiction for any given cloud provider is probably regulatory pressure for data protection, however, you largely don't have this problem if you are paranoid about your users' privacy anyway. Other drivers might be operational security (resistance to regulatory change, cloud provider account closure or hijacking, physical asset seizure, disasters, etc.) To ensure the latter whilst considering the former a fair rule of thumb might be to engage multiple independent cloud providers within the same legal jurisdiction to ensure legally permissible, automated cloud provider failover or migration. While you could probably legally put the case that encrypting data before migrating it overseas constitutes reasonable protection and therefore avoids the ire of regulators, given that Europe is one jurisdiction for these purposes it's fair to say that route is often slow (due to bandwidth intensive nature) between major markets. Ahh, no easy solutions :)