Cloud and infrastructure services agreement

IaaS, PaaS, SaaS and managed services allocate control differently. The agreement must describe the service purchased and avoid a blanket exclusion treating every configuration as exclusively the customer’s responsibility.

Privileged accounts, encryption, patches, backup, monitoring and restoration are established. A RACI matrix can turn general standards into verifiable tasks.

The customer must know what data enter the service, where they may be stored, who may access them and how they are separated from other customers’ data.

• Hosting regions and whether they may change.
• Subcontractors and the change-notification mechanism.
• GDPR roles, transfers and assistance with individuals’ rights.
• Encryption, keys and provider staff access.
• Backup, RPO, RTO and restoration testing.
• Logs, retention and access to evidence after an incident.

The Data Act establishes minimum requirements for data processing service agreements and requires covered providers to remove unjustified barriers to switching and multi-cloud. The agreement must identify exported data, format, transition period and assistance.

Switching and egress charges are transitional and must be fully eliminated from 12 January 2027 for covered operations. Until then, permitted charges must be transparent and linked to actual expenditure within the Regulation’s limits.

Government Emergency Ordinance No. 155/2024, approved with amendments by Law No. 124/2025, transposes the NIS2 framework in Romania. Cloud, data centre and managed-service providers and other entities may fall within its scope under the statutory criteria.

Implementing Regulation (EU) 2024/2690 details measures and criteria for categories of digital providers. The agreement must enable incident notification, cooperation, auditing and access to necessary information without creating conflicts between customer and provider.