GDPR - Your questions answered

GDPR is an acronym for General Data Protection Regulation.

The notion of the GDPR directly references Article 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC.

There are several texts that determine regulations regarding personal data protection, providing general and more precise guidelines:

• Internationally: Convention 108, for the Protection of Individuals with regard to Automatic Processing of Personal Data, is a binding treaty open for signature to all countries.
• In Europe: Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data GDPR), as well as Directive 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
• Nationally: Many countries have adopted national regulations on the protection of personal data. For example, this is the case for all EU member countries.

The notion of personal data is defined in article 4 of the GDPR as being “[...] any information relating to an identified or identifiable natural person [...] an identifiable natural person is one who can be identified, directly or indirectly [...]”.

In other words, personal data is a piece or collection of data that in any way allows an individual to be identified.

A piece of data indirectly allows an individual to be identified if simply reading it alone does not give away the individual’s identity, but additional research allows the individual to be identified. This is typically the case with an email address, for example.

Yes, to a certain extent. One of the obligations of a data controller is to select data processors providing sufficient guarantees that personal data is processed in accordance with the regulation.
In other words, the guarantees offered by OVH as a data processor mean that you can comply with a part of your own obligations. Among these guarantees, you will be able to find the security measures put in place by us, the commitments made in terms of the locations in which your data is processed, and more.

The obligations of a data controller are, however, not limited to selecting a GDPR-compliant service provider. They go well beyond OVH’s scope of intervention as an IT processor. As a data controller, you cannot ensure that you are fully GDPR-compliant simply by selecting your processor carefully. You must also comply with the obligations that apply to you: respecting the rights of individuals, and carrying out analyses on the impact on a person’s private life, for example.

As a cloud services provider, OVH takes on the role of a data processor. This means that OVH makes the following commitments in particular:

1. Not reusing the data hosted on our services: OVH processes its customers’ personal data solely for the purpose of fulfilling its services, and always follows the customer’s instructions when doing so.
2. Offering data reversibility: At OVH, all of our cloud solutions are based on open standards, including a number of open-source technologies. This way, you can recover and migrate your data easily, as your data is always reversible and interoperable.
3. You will always know exactly where your data is stored and processed.
4. We guarantee complete transparency with regard to the recourse we have to subsidiaries as processors.
5. We will notify you if you are the subject of a data breach.
6. We produce comprehensive documentation for all our services: OVH will provide you with all the appropriate documentation, including a description of the security measures put in place for your services, an attestation of the location your data is stored in, and more.
7. We contractually guarantee our commitments: OVH commitments are not empty promises. They are contractually integrated into our Data Processing Agreement (DPA). This document is provided as an attachment to our contracts. It is available on request to all of our customers.

When you select a service that enables you to store your content and personal data, datacentre locations and geographical regions are always listed on our website. If several possible locations or geographical regions are available, you can choose a location when you place your order.

However, “data storage” is not synonymous with “data processing”. The GDPR sets rules for “processing”, not just for “storage”. In light of this, it’s good to take special care when you use these two terms.

When you select a storage region located in the EU, OVH guarantees that it will not process your data outside of the European Union, and any countries recognised by the European Commission as having a sufficient level of personal data protection regulations in place (with regard to the private lives, fundamental rights and freedoms of persons, and also with regard to exercising corresponding rights [adequacy decision]). We also guarantee that we will never process your data in the US.

OVH processes its customers’ personal data solely for the purpose of fulfilling its services, and always follows the customer’s instructions when doing so.

The data hosted within our services by customers remains the property of the customer.

Any resale of the aforementioned data, as well as any use of the data for commercial purposes (e.g. profiling activity, or direct marketing), is strictly prohibited.

To ensure that OVH’s commitments allow you to comply with part of your obligations, you will need to stipulate them within a contract, or any other legal act that binds OVH to you.

OVH provides you with this opposability in two ways:

• The General Terms and Conditions of Service apply to all OVH services, and include clauses on personal data protection.
• Furthermore, upon request, OVH can sign a specific additional clause for your contract, entitled a Data Processing Agreement (DPA). Data Processing Agreements are solely dedicated to setting out the guarantees offered by OVH in terms of personal data processing.