Krishnan Subramanian's Library tagged regulatoryissues →  View Popular

She points to a 9th Circuit Court of Appeals ruling stating that, under the Stored Communications Privacy Act, providers of hosted email/SMS services may not turn over messages to the company that's paying for the service without a warrant. In other words, if you contract with a cloud provider to manage your employees' email, that provider may not supply you with copies of messages on demand, even though you're footing the bill. This could throw a serious wrench into e-discovery or internal investigations.

companies doing business within the European Union need to ensure that EU citizens' private data doesn't reside in countries that have less stringent laws – like, say, most of the U.S. And because of its strict privacy laws, Lawson says, before California governmental organizations consider cloud computing, they must make sure that private data remains within state borders or, after conferring with lawyers, that hosting data in other states or countries is acceptable.

Call in the lawyers now, because whether you're subject to PCI or HIPAA or both, you need to ask detailed questions about where and how data is stored and who's responsible for it. And the answers have to be addressed in your contract.