2. Data Security. Head in the Clouds. (And hoping it's safe)

November 24, 2025·41 min·3 clips

Microsoft OneDrive’s 30-day recycle bin is a restore limit, not a full recovery strategy.

1. GDPR Now! episode 2 examines cloud services and why 'in the cloud' is not enough for data security. 2. Karen Heaton, owner of Data Protection for Business, hosts Stuart and Darren from Provision IT, where Darren is technical director and Stuart represents the outsourced hybrid support side. 3. The episode asks what responsibility stays with the customer after data moves into Azure, AWS, Salesforce, or Microsoft 365. 4. Darren separates public cloud, private cloud, and hybrid cloud, using Azure and AWS as public-cloud examples and on-premise virtualization as private cloud. 5. He describes public cloud as pay-as-you-go infrastructure that can scale up or down in minutes across multiple regions. 6. Private cloud is framed as a virtualized physical environment, while hybrid cloud combines private and public systems during migration. 7. The discussion then maps IaaS, PaaS, and SaaS to different responsibility boundaries, from physical hardware to managed applications. 8. In IaaS, the customer still handles the operating system, security updates, antivirus, and backups even after the server moves off-premise. 9. In PaaS, the provider manages the operating system, but the customer remains responsible for third-party software and the data placed on the platform. 10. In SaaS, the provider manages infrastructure, networking, operating systems, and databases, while the customer still owns identities and access. 11. Karen and Darren say supplier due diligence matters because cloud users are transferring risk to a third party, not removing it. 12. They ask where the data is held, how long it is retained, and whether the contract covers backups and recovery. 13. Darren points to Microsoft OneDrive's 30-day recycle bin as a limited restore window rather than a full disaster-recovery plan. 14. Karen and Stuart push the recovery point objective and recovery time objective questions, including whether an hour of lost finance work is acceptable. 15. Stuart describes a care-sector SaaS provider that had been hit by ransomware and left customers recovering for months. 16. The episode also returns to logging, because Darren says organizations need evidence of what was downloaded during a credential breach if they have to answer the ICO. 17. The tone stays practical and conversational, with Karen pressing contract terms and Darren answering in operational language. 18. The format is a host-led interview with extended examples, short definitions, and procurement advice rather than abstract theory. 19. SMB IT leads and data protection owners will get the most from it. 20. Teams wanting marketing-level cloud advice, not procurement detail, can skip it.

As heard by us

A practical review of why cloud security rests on verified backups, contracts, access control, and clear responsibility.

Cloud services are treated here as a responsibility problem, not just an IT preference. The episode follows Karen Heaton of Data Protection for Business with Stuart from Provision IT and Darren as they work through SaaS, public, private, and hybrid cloud risks: deleted files,…

Read the full review in PlayNext →

Why you'd press play

You may trust the cloud; this episode asks how ready you are when that trust meets deletion, recovery gaps, or ransomware.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from GDPR Now!