Drafring a cloud computing contract

Drafting a cloud computing contract 

Legal Framework 

Cloud agreements in Belgium are shaped by several overlapping legal frameworks. Belgian contract law provides the general foundation governing the formation, performance and termination of cloud service agreements. Where personal data is processed, GDPR imposes specific obligations on both controllers and processors. Depending on the nature of the cloud provider's activities, cybersecurity obligations under NIS2 (and its Belgian implementing legislation) may also apply. In addition, the rules on unfair contract terms must be taken into account when drafting and negotiating cloud agreements. Sector-specific regulations, such as those applicable to financial services or healthcare, may impose additional requirements regarding data localisation, outsourcing and regulatory oversight. Because cloud services often involve cross-border processing, international data transfer rules under GDPR are of particular importance and must be carefully addressed.

Key elements

1. Service model and scope: Define the service model being provided, whether Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS) or a hybrid combination thereof. The functional scope of the services must be described with sufficient precision, including the specific functionalities, environments and resources made available to the customer.

2. Service Level Agreements (SLAs): Include measurable uptime commitments, clearly defined incident response times, structured escalation procedures and appropriate remedies in the event of non-compliance, such as service credits or, where appropriate, stronger contractual remedies. It is important to note that service credits should not automatically operate as an exclusive remedy excluding the customer's right to claim damages, unless this has been consciously negotiated and accepted by the parties.

3. Data processing: Where the cloud provider processes personal data on behalf of the customer, a data processing agreement compliant with Article 28 of the GDPR is mandatory. The agreement must clearly allocate the respective roles of controller and processor, specify the technical and organisational security measures to be implemented by the provider, ensure transparency regarding the use of sub-processors and establish appropriate safeguards for any international transfers of personal data outside the EEA. Cybersecurity representations made by the provider should be aligned with its actual technical capabilities, and the customer should retain the right to audit compliance with the agreed data protection obligations.

4. Data ownership and exit: Confirm whether all data uploaded or generated by the customer remains the customer's property at all times. Upon termination or expiry of the agreement, the provider should be required to make the customer's data available in a portable and commonly used format, to provide reasonable transition assistance to facilitate migration to an alternative provider, and to grant post-termination access to the data for a defined period. Following the completion of the transition, the provider should be obligated to permanently delete all customer data and to certify such deletion in writing. Vendor lock-in risk is primarily contractual in nature, and addressing these provisions at the drafting stage is essential to preserving the customer's ability to change providers.

5. Liability and limitations: Cloud providers frequently propose broad liability caps and blanket exclusions for indirect or consequential damages. When negotiating these provisions, particular attention should be given to ensuring appropriate carve-outs from any liability limitations, notably in respect of data breaches, breaches of confidentiality obligations, intellectual property infringement and wilful misconduct or gross negligence. Under Belgian law, liability for willful misconduct cannot be contractually excluded.

6. Business continuity and insolvency: The cloud contract should address business continuity and disaster recovery obligations, including the provider's obligation to maintain adequate backup and disaster recovery procedures, to implement and regularly test a business continuity plan, and, where critical software components are involved, to put in place escrow arrangements ensuring the customer's continued access to the source code in the event of the provider's insolvency or cessation of activities.

Given the degree of digital dependency inherent in cloud services, cloud contracts should not be seen as purely IT agreements, but as core infrastructure contracts that require careful legal structuring.