94
include SaaS, PaaS and IaaS by a provider. Generally, these services will be
provided via the internet. From a practical perspective, Cloud computing is a
package of services including the supply of computer and storage capacities,
software and sometimes consultancy services, in other words an entire IT‐
infrastructure.
Statutory laws of most jurisdictions have not anticipated such a broad
package of services. The legal appraisal needs to take special features into
account that arise from this new combination of various service
components. Therefore, it is crucial to draft appropriate agreements giving
most foreseeability to the parties as to what services will be provided, what
costs are involved, how termination of the agreement is possible, at what
costs, with what post‐termination support including migrating data to
another platform.
3.3.6
Preparing the agreement
Choosing services
Just as Cloud service offerings are modular and scalable, entering the Cloud
is not an "all or nothing" decision for a business. Especially where doubt
exists as to whether Cloud computing is the right technology for the user’s
business and will offer the expected benefits. It is advantageous to
outsource only a limited portion of the services that could potentially be
handled in the Cloud in order to gain experience with Cloud computing and
define the further strategy based on this.
After identifying the Cloud service candidates, the selection is typically
sanitised to exclude services that transfer sensitive data. It is important to
determine the sensitivity of the company's applications and data at this
point. For example, e‐mail traffic is typically deemed sensitive, as it contains
business data. However, on closer inspection, this typically only applies to a
small proportion of all e‐mail traffic.
In the case of data classified as sensitive for contractual or legal reasons, a
precise appraisal is no longer significant; instead one needs to precisely
analyse whether, and if so under what conditions, data can be handed over
to a third party. Even if this third party only stores and manages the data, as
is the case with Cloud computing (that is moves the data between virtual
and physical servers), but does not actually view the data.
