Home › Guides

Assess cloud ERP personal data across hosting, support and legal entities

A hosting-region promise describes one part of a cloud service. It does not identify every organization that can access payroll attachments, customer contacts, logs or support exports. Approve the actual data flows and processing roles before treating the region choice as complete.

Use the cloud ERP data-flow worksheet with procurement, privacy and security owners. This guide recommends an assessment process. It distinguishes EU and UK guidance and does not impose one worldwide data-residency rule.

Define the data and processing purpose

Inventory employee, supplier, customer and other personal information in structured fields, attachments and integration messages. Include free-text descriptions, bank details and support-ticket exports. Identify health or other sensitive information where relevant and give it the appropriate specialist review.

Record why each category is processed, who needs it and the retention basis. Do not assume every diagnostic bundle needs a complete payroll database. Give the business owner responsibility for the purpose and the application owner responsibility for the configured access.

Separate a production use from implementation testing, analytics, support and backup. A provider may perform several activities under different instructions. Ask whether any activity uses customer data for the provider's own purposes and have privacy determine its role for that activity.

Determine roles from actual activities

Identify the legal entities acting as controller, processor and any subprocessors for each processing activity. Contract labels should reflect who determines purposes and means and who processes on another party's instructions.

The EDPB's final controller/processor guidance explains those functional roles and the importance of their factual allocation. A commercial description such as implementation partner does not establish the legal role. EDPB, Guidelines 07/2020.

Map the contracting chain. Name the ERP provider, hosting supplier, implementation partner, support companies and other recipients. A subsidiary with the same brand is still a separate legal entity. Record its role and approved activity instead of relying on the group's logo.

Procurement obtains the processing terms, instructions, subprocessor information, change process and exit provisions. Privacy approves the role and legal analysis. Security verifies how those commitments are implemented. Finance and HR confirm whether the proposed service meets the business purpose.

Map location and access separately

Record production storage, replicas, backup, disaster recovery, logs, telemetry, ticketing and exported reports. For each, record where data sits, which organization can access it and from which countries. Distinguish ordinary access from exceptional emergency support.

Include onward processing even when the customer never sends the file itself. The initiating party and contractual instructions matter. Do not assume that customer responsibility or processor responsibility is identical for every step in a supplier chain.

The ICO's January 2026 guide identifies its UK restricted-transfer test, including the initiation of a transfer to a separate organization outside the UK. It treats making information accessible as relevant alongside sending a copy. ICO, brief guide to international transfers.

Assess EU and UK transfer routes independently

For each applicable law, have privacy determine whether the flow is a regulated international transfer, who is responsible and which current mechanism and conditions apply. Record any adequacy decision, contractual safeguard, assessment and supplementary measure actually relied upon. Do not assume one document or country classification automatically satisfies both EU and UK requirements.

For EU transfers using relevant safeguards, the EDPB recommendations explain the assessment of transfer tools and possible supplementary measures. Review the actual destination, access and service rather than treating a signed clause as the whole analysis. EDPB, Recommendations 01/2020, final version.

Distinguish security design from legal permission. Encryption can protect data, but its effect depends on key control and whether support personnel can obtain plaintext. Keep the approved transfer route and security controls as related, separately evidenced decisions.

Work a hosting-and-support review

Consider a synthetic UK company using a UK legal entity as its ERP provider. Production and backup data sit in an EU region. The provider proposes support from its own employee temporarily abroad and from a separate support company in India. Assume UK GDPR applies to the customer's processing.

The company initially records only "EU hosting" in its questionnaire. That answer misses three issues: overseas storage, the employee's access and access by the separate Indian organization. The legal assessment must classify each actual flow and initiation arrangement.

The ICO explains that access by a separate overseas organization can qualify as a restricted transfer, while access within the same legal entity has a different transfer analysis. Other security and data-protection duties still apply. ICO, are we making a restricted transfer?.

Privacy therefore records the storage and recipient arrangements, identifies which party initiates each relevant transfer and determines the current lawful route. It does not approve India access merely because storage remains in the EU, or declare the employee scenario equivalent solely because both logins originate abroad.

The support team requests a copy of 1,200 payroll records to reproduce a calculation problem. The application owner instead produces eight synthetic records that recreate the rounding issue without real employee details. The test verifies the issue with those eight records. Real identifiers and attachments remain outside that diagnostic bundle.

That reduction is a proposed control, not proof that all support activity is anonymous. If real logs or indirect identifiers remain, assess them as personal information where applicable. If real access is still necessary, approve its scope and legal conditions before enabling it.

Test the safeguards against the agreement

Verify access permissions, approval expiry, authentication, logging and export restrictions for the actual support role. Demonstrate revocation and confirm the operator cannot access unrelated modules. Include emergency access in the test instead of assuming it follows normal permissions.

Check whether a subprocessor change creates a review event before new processing starts. Procurement tracks notices and contractual rights; privacy decides the legal effect; application and security owners implement restrictions or migration where needed.

If a support export went to an unapproved recipient, preserve the access and transfer evidence and activate the incident process. Privacy determines notification and remediation duties. Deleting the ticket attachment does not establish that no recipient copy exists.

Approve retention and exit together

Record what happens to active records, backups, support copies and audit logs at termination. Reconcile deletion commitments with applicable recordkeeping obligations and holds. An ERP export should preserve required finance evidence without copying unnecessary personal information into every project folder.

☐ Data categories, purposes and owners are documented.
☐ Roles identify legal entities and actual processing activities.
☐ Storage, remote access, onward recipients and initiation are mapped.
☐ Applicable EU and UK transfer decisions have separate evidence.
☐ Support access and diagnostic exports pass practical restrictions.
☐ Subprocessor changes, incidents, retention and exit have owners.
☐ The approved assessment describes the actual deployed service.

Use invoice archive operations for live finance evidence and provider selection for contract and exit questions.

Sources checked 17 October 2026. No particular destination is declared adequate or prohibited here; current mechanisms and sector-specific restrictions require the actual privacy assessment.

Worksheet: Cloud ERP data-flow and transfer assessment

Copy this worksheet for each case. It records decisions and evidence; it does not determine the tax or legal treatment.

Show the worksheet

Use with the cloud privacy guide. This worksheet records the actual privacy review, not an automatic compliance score.

Define the processing

Business, provider legal entity and service version: ____
Data categories, people concerned and sensitive information: ____
Processing purposes and business owners: ____
Controller/processor/subprocessor roles by activity: ____
Applicable laws and privacy reviewer: ____

Map every flow

Copy this block for production, backup, disaster recovery, logs, ticketing, support access and exports.

Data and purpose: ____
Source and receiving legal organizations: ____
Storage location and access countries: ____
Contracting chain and party initiating the relevant transfer: ____
EU transfer analysis and actual mechanism/conditions if applicable: ____
UK transfer analysis and actual mechanism/conditions if applicable: ____
Supporting assessment and approved safeguards: ____
Access scope, key control, logging and expiry: ____
Retention, incident and exit responsibilities: ____

Rehearse the support scenario

Can synthetic records reproduce the fault? Result/evidence: ____
If real data is necessary, approved minimum and purpose: ____
Remote access by own employees versus a separate recipient assessed: ____
Exceptional access approval and revocation demonstrated: ____
Remaining identifiers in diagnostics or logs assessed: ____

☐ Hosting region does not substitute for the recipient/access map.
☐ Roles follow actual activities and legal entities.
☐ EU and UK transfer decisions remain separate.
☐ Security controls match the promised service.
☐ Subprocessor changes and unapproved exports trigger review.
☐ Retention and exit preserve required records without unnecessary copies.

Privacy approval and date: ____

Security/business acceptance and date: ____

Country pages: key facts with sources
E-invoicing matrix: country × ERP support
All guides

Vendor documentation is cited only as an example of the level of evidence to ask for; it is not a recommendation or a ranking. This guide is general information, not tax or legal advice. Checked 2026-10-17.

Related: Glossary – abbreviations and terms used in these guides (SAF-T, Peppol, CTC, EN 16931, IFRS and more).

Page last updated: 2026-10-17 · Markdown version