| Topic |
Considerations |
Data Law
|
| 1. Reconsidering Commercial Practices |
Are open-ended cloud credits offered to the cloud provider’s customers? Are these credits granted in exchange of an exclusivity commitment?
Companies that offer cloud credits should reconsider this practice.
The SREN law (Article 26) prohibits cloud providers from granting open-ended cloud credits and cloud credits granted subject to a condition of exclusivity. A supplementary regulation is expected to define a maximum period of validity for each category of cloud credits.; |
SREN law provisions. |
Are open-ended cloud credits offered to the cloud provider’s customers? Are these credits granted in exchange of an exclusivity commitment?
Companies that offer cloud credits should reconsider this practice.
The SREN law (Article 26) prohibits cloud providers from granting open-ended cloud credits and cloud credits granted subject to a condition of exclusivity. A supplementary regulation is expected to define a maximum period of validity for each category of cloud credits. |
SREN law provisions. |
Are conditional sales included in the cloud provider’s practices/contracts?
Cloud providers whose practices include conditional sales should make sure that does not constitute an unfair commercial practice.
The SREN law (Article 26) prohibits providers from making the sale of a product/service conditional upon the simultaneous conclusion of a contract to provide cloud services, where this constitutes an unfair commercial practice under French law. |
SREN law provisions. |
If software is provided as part of the cloud providers’ services (as opposed to IaaS or PaaS), are the pricing/functional terms different compared with when provided through a third-party service?
It’s important to justify any difference in pricing/functional terms.
The SREN law (Article 26) says cloud providers that also provide software may not provide software to a customer through a third-party cloud provider on pricing and functional terms that differ significantly from those under which the cloud provider provides the same software through its own cloud service if such differences are not justified (“autopréférence”). |
SREN law provisions.
|
| 2. Complying with Transparency Obligations |
Are customers systematically informed of financial implications of switching providers (if any) before entering into an agreement?
If customers are not provided with this information, companies should include it as part of negotiations/commercial discussions.
Cloud providers must communicate clear information to prospective customers and make such information publicly available on standard service fees and early termination penalties that might be imposed, as well as on any switching charges that might be imposed, according to the Data Act (Articles 29(4) to 29(6)). If a service involves a highly complex or costly switching process or if it is impossible to switch without significant interference to the data, a company must mention that.
The SREN law (Article 27) also requires cloud providers to communicate to customers and potential customers in a clear and comprehensible manner, in particular prior to the signing of a contract, information on data transfer and provider switching charges, including the nature and amount of such charges.
Exemptions apply to services that mainly consist of features or components that are custom-built or developed for the specific needs of a customer and pre-release versions. |
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
Are customers systematically informed of technical and operational procedures for switching providers?
Cloud providers need to provide this information if they are not already doing so.
The Data Act (Article 26) requires providers to communicate information on procedures for switching and porting, including on methods and formats as well as restrictions and technical limitations. The law does not specify whether it needs to be publicly available and how to communicate this information. In the absence of guidance and as a risk-mitigating measure, cloud providers should consider publishing a notice on their website.
Providers also must create and update an online register with details of data structures and formats as well as the relevant standards and open interoperability specifications in which the exportable data is available. |
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
|
Does the cloud provider’s website contain information concerning the location of the infrastructure used to provide services and measures taken to prevent access to or transfer of data conflicting with EU law? Is information provided on environmental considerations?
Cloud providers should add this information to their websites if it is not already there.
The Data Act (article 28(1)) requires cloud providers to disclose on their websites:
- Details on the jurisdiction with laws and regulations governing the information and communication technology (ICT) infrastructure used for data processing.
- A description of the technical, organizational and contractual measures adopted to prevent international governmental access to or transfer of non-personal data held in the EU if that would conflict with EU law or the national law of the relevant Member State.
Customer contracts must also refer to the websites where this information is provided.
The SREN law (Article 33) provides a similar obligation. It also requires cloud providers to include information on their websites about the environmental footprint of the services, including carbon footprint, water consumption and energy consumption.
|
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
| 3. Reviewing Contractual Terms |
Do customer contracts contain the rights of the customer and obligations of the cloud provider in relation to switching cloud providers?
Companies should ensure that customer contracts include this information.
The Data Act (Article 25) grants rights to customers in relation to switching cloud providers within a given timeline. The Data Act also requires companies to provide information on switching charges, exportable data and their full erasure. These rights, obligations and associated information must be provided in a contract that shall be made available to the customer before signing in a way that allows the customer to store and reproduce it.
The SREN law (Article 27) contains the same requirement. It adds that, for contracts already in force when the SREN law took effect, providers shall inform customers of the nature and amount of the data transfer charges and switching charges. |
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
Are switching charges applied?
Cloud providers that impose switching charges on customers should reconsider that practice.
Under the Data Act (Articles 29(1) to (3)) until 12 January 2027, cloud providers may impose reduced switching charges on the customer (not exceeding the costs a provider incurs that are directly linked to the switching process). From 12 January 2027, cloud providers shall not impose any switching charges.
The SREN law (Article 27) also restricts switching and data transfer charges. A supplementary regulation will provide more details. Authorities may delay enforcing these rules pending the supplementary regulation, although the law does not require that.
Exemptions apply to services that mainly consist of features or components that are custom-built or developed for the specific needs of a customer and are pre-release versions. |
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
| 4. Product Adaptations |
Are processes in place to help customers achieve functional equivalence when switching provider?
Cloud providers will need to adapt processes if they provide services limited to infrastructural elements (servers, networks, virtual resources)
The Data Act (Article 30(1)) requires cloud providers to take all reasonable measures so the customer, after switching cloud providers, achieves functional equivalence in using the new cloud provider’s service. Cloud providers must facilitate switching by providing capabilities, information, documentation, technical support and, where appropriate, necessary tools.
If services provided by the cloud provider are not limited to infrastructural elements, customers must receive information to facilitate the switching process.
The Data Act ( Article 30(2)) requires cloud providers to make available open interfaces with information to facilitate switching (Article 30(2)) and ensure compatibility with interoperability standards when these standards are published. In the absence of harmonized standards, cloud providers should, at the request of the customer, export all exportable data in a structured, commonly used and machine-readable format.
The SREN law includes interoperability and portability requirements that are not yet specified.
Exemptions apply to services that mainly consist of features or components that are custom-built or developed for the specific needs of a customer and pre-release versions. |
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |
5. Reconsidering Obstacles to Changing Cloud Provider
|
Do contractual and operational practices create obstacles that restrict the ability of customers to easily change cloud providers?
The Data Act (Article 23) prohibits cloud providers from imposing obstacles that inhibit customers from:
- Terminating the agreement after switching.
- Concluding new contracts with a different provider covering the same services.
- Porting customer’s data to a different provider or an on-premises infrastructure.
- Achieving functional equivalence in the use of a new provider.
- Unbundling cloud services that do not provide access to the operating services or software stored or deployed on infrastructural elements from services that provide access to such operating services or software.
Cloud providers need to cooperate to make the switching process effective, enable the timely transfer of data and maintain the continuity of the cloud service (Article 27).
|
Obligations imposed under the Data Act and France-specific provisions under the SREN law. |