Legal Issues in the Cloud: Exploring Business Continuity, Liability and SLA-related Issues

Many companies are familiar with ‘e-discovery’ and have data retention, storage and destruction policies in place that apply in the event of litigation. If a cloud customer is sued, or there is the threat of litigation, the customer may have to initiate a ‘litigation hold’ to preserve documents, including electronic documents and any metadata in the documents. This could present a challenge in the cloud if the customer’s data is commingled with that of other clients or if the customer’s data is stored on parallel servers. Cloud customers should determine the vendor’s ability to prevent the destruction, alteration or mutilation of customer data in the vendor’s possession, as well as the vendor’s search capabilities for the data. Cloud customers should also make sure that their corporate policies and procedures account for any data in the cloud. Do the data retention and destruction policies of the cloud vendor align with those of the customer?

As for the vendors, they need to develop a process for dealing with e-discovery requests and should provide notice to their customers promptly (within hours, not days) of any subpoena or other legal process seeking access to the customer’s data. Vendors may also need to provide the customer with access to its logs and reports to verify the security, integrity and chain of custody of the customer’s data.

Posted in: Andrew L. Goldstein,Cloud Computing