# Standards and Regulatory References for Cloud Migration Privacy

## Primary Legislation
- **GDPR Art. 28**: Processor obligations and DPA requirements.
- **GDPR Art. 32**: Security of processing — controller must assess CSP security measures.
- **GDPR Chapter V (Art. 44-49)**: International transfer framework for cloud-hosted data.
- **GDPR Art. 35**: DPIA required when cloud migration meets WP248 criteria.

## EDPB Guidance
- **Guidelines 07/2020 on controller and processor concepts**: CSP role determination.
- **Recommendations 01/2020 on supplementary transfer measures**: TIA for cloud transfers.
- **Recommendations 02/2020 on European Essential Guarantees**: Surveillance assessment for CSP jurisdictions.

## Cloud Security Standards
- **ISO/IEC 27017:2015**: Code of practice for information security controls for cloud services.
- **ISO/IEC 27018:2019**: Code of practice for protection of PII in public clouds acting as PII processors.
- **ISO/IEC 27701:2019**: Privacy information management — Section 8.5 (PII processor requirements).
- **SOC 2 Type II**: Service Organisation Control report for security, availability, processing integrity, confidentiality, and privacy.
- **BSI C5 (Cloud Computing Compliance Criteria Catalogue)**: German federal standard for cloud security.
- **CSA STAR (Cloud Security Alliance Security Trust Assurance and Risk)**: Cloud-specific security certification.
- **EUCS (EU Cloud Services Scheme)**: European cybersecurity certification scheme for cloud services under the Cybersecurity Act.

## Enforcement Decisions
- **DPC Ireland vs Meta (IN-21-3-3, 2023)**: EUR 1.2 billion for US transfers via cloud infrastructure.
- **DPC Ireland vs Microsoft/LinkedIn (2023)**: EUR 310 million — controller-processor clarity in cloud advertising.
- **Dutch SLM Rijk DPIA on Microsoft 365 (2022)**: Eight high-risk findings in cloud office suite processing.
- **German BfDI Microsoft 365 assessment (2022)**: Advised against federal use due to data transfer and transparency concerns.