Rewritten in November 2026 to reflect the law at that date. This is general information, not legal advice.
Cloud services now hold much of the personal data UK organisations are responsible for. Earlier advice often pointed organisations to a single product feature, such as Apple's Advanced Data Protection for iCloud. That advice is out of date. This guide sets out what UK data protection law expects when you use cloud storage, what to look for in any provider, and how Apple and Microsoft products compare against those requirements.
What has changed with Apple's Advanced Data Protection
Advanced Data Protection (ADP) is an optional iCloud setting that adds end-to-end encryption to more categories of data, including iCloud Backup, iCloud Drive, Photos and Notes, so that only the user's trusted devices hold the keys. In February 2025 Apple stopped offering ADP to UK users who had not already turned it on. According to Apple's UK support notice, users who had not enabled ADP no longer have the option to do so, and Apple cannot switch it off automatically for existing users. Instead, Apple says existing UK users will be given a period of time to disable it themselves to keep using their iCloud account. Check that page for Apple's latest position before relying on ADP.
For organisations, there is a more basic point: Apple states that Managed Apple Accounts are not eligible for ADP. ADP was always a consumer account feature, so it was never a sound basis for an organisation's data protection strategy.
Without ADP, iCloud uses standard data protection: data is encrypted in transit and at rest, but for most categories Apple holds the keys. Some categories, such as Passwords and Keychain and Health data, remain end-to-end encrypted.
What the law requires
The UK GDPR does not require any specific product. It requires you to think about risk and choose appropriate measures. The regulator is now the Information Commission. On 30 September 2026 it took over the functions of the Information Commissioner's Office (GOV.UK announcement), and it is still widely referred to as the ICO. Your obligations under the UK GDPR and Data Protection Act 2018 are unchanged.
Security (Article 32)
Controllers and processors must put in place appropriate technical and organisational measures to ensure security appropriate to the risk. The ICO's guide to data security names encryption and pseudonymisation as examples, and recommends encrypting stored personal data and data sent over the internet.
Processor contracts (Article 28)
A cloud provider that stores or handles personal data for you is usually your processor. You must have a written contract covering, among other things, processing only on your documented instructions, confidentiality, security, use of sub-processors, help with data subject rights, end-of-contract deletion or return, and audits. See the ICO's guidance on contracts between controllers and processors. Large providers offer standard data protection terms; check that they cover these points.
International transfers
If data leaves the UK, you need a lawful transfer route. Options include adequacy regulations, including the UK–US data bridge (in effect since 12 October 2023), which covers US organisations participating in the UK Extension to the EU–US Data Privacy Framework, or safeguards such as the International Data Transfer Agreement or UK Addendum. See the ICO's international transfers guidance.
Breach notification
If a personal data breach is likely to create a risk to people's rights and freedoms, you must report it to the regulator as soon as possible and, where feasible, within 72 hours of becoming aware. If the risk is high, you must also tell the people affected without undue delay (ICO breach guidance). Your processor contract should require the provider to tell you about breaches promptly.
A checklist for any cloud provider
| Feature | What to ask |
|---|---|
| Encryption in transit and at rest | Is all data encrypted by default, and with what standards? |
| Key management | Who holds the keys? Can you use customer-managed keys or hold your own key for the most sensitive data? |
| Access controls | Can you enforce multi-factor authentication, least-privilege roles and conditional access? |
| Logging and monitoring | Are access and admin actions logged, and can you keep and review those logs? |
| Data residency | Can you choose where data is stored, and is that a contractual commitment? |
| Contract and transfers | Does the data processing agreement meet Article 28, and what transfer mechanism covers any data sent abroad? |
| Recovery and deletion | Are there backups, and can data be returned or deleted when you leave? |
End-to-end encryption, where only you hold the keys, gives strong protection against provider-side access, but it can limit features such as search, sharing and recovery. Decide based on your risk assessment, not on a single feature.
Worked example: Microsoft
- Default encryption: Microsoft 365 data is encrypted at rest using BitLocker and Distributed Key Manager. Microsoft Purview Customer Key adds a layer using root keys you control, covering Exchange, SharePoint, OneDrive and Teams data, subject to licensing.
- Labelling and protection: Microsoft Purview Information Protection provides sensitivity labels, encryption of documents and emails, data loss prevention and Double Key Encryption, where only your organisation can decrypt protected content.
- Key storage: Azure Key Vault stores keys, secrets and certificates, with HSM-protected keys in its Premium tier and logging of access.
- Identity: Microsoft Entra ID (formerly Azure Active Directory) supports multi-factor authentication and Conditional Access policies.
- Residency: the UK is one of Microsoft's Microsoft 365 data residency geographies, with storage commitments for core services shown in the admin centre.
Worked example: Apple
- Standard protection: iCloud data is encrypted in transit and at rest, with Apple holding most keys.
- Advanced Data Protection: not available to new UK users, and never available to Managed Apple Accounts.
- Fit for organisations: iCloud is designed mainly for personal use. Organisations using Apple devices typically pair them with a device management service and a business storage platform that offers admin controls, processor terms and audit logs.
Whichever provider you choose, record your decision in your risk assessment or data protection impact assessment, and review it when products or the law change.
Key points
- Apple's Advanced Data Protection is not available to new UK users and does not apply to Managed Apple Accounts.
- UK GDPR requires security appropriate to the risk, not a particular product.
- Check encryption, key control, MFA, logging, residency and recovery for any provider.
- Have an Article 28 processor contract and a lawful route for any international transfer.
- Report qualifying breaches to the Information Commission within 72 hours where feasible.