Most research teams choose a cloud storage or survey platform based on familiarity, ease of use, or what a previous study already used, without necessarily revisiting the compliance question each time. A tool that looked compliant when it was first adopted isn't automatically still the right choice for the data and population involved in a new one — data protection law and a provider's own terms both change over time, and the question needs asking again rather than assumed answered.
The problem
A tool chosen years ago rarely gets its compliance re-checked — familiarity gets mistaken for compliance, study after study. A platform a colleague used successfully on a different study isn't automatically the right choice for a new one, since data protection law and a provider's own terms both drift quietly over time, often without an obvious trigger prompting anyone to look again.
The challenge
Data protection law and a provider's own terms both change quietly over time, and a platform's marketing rarely tells the full story of where data actually ends up. The 2020 Schrems II ruling established that standard contractual clauses alone don't automatically guarantee adequate protection when a transfer involves US surveillance law considerations — many widely used platforms are headquartered in, or route data through, jurisdictions this directly concerns. The sub-processor terms — the other companies a platform itself relies on for hosting, analytics, or support — often reveal a longer chain of data handling than the headline pitch suggests, spanning jurisdictions the primary platform doesn't prominently advertise.
The solution
- Check where the provider actually stores and processes data — mapped per sub-processor, not assumed as one blanket status for the whole platform.
- Read the sub-processor terms, not just the headline pitch — this is where the real compliance picture usually becomes clear.
- Confirm safeguards for any transfer outside the UK or EU — an adequacy decision where one applies, standard contractual clauses plus supplementary measures where it doesn't.
The most reliable point to catch a gap is before a tool is adopted, as part of procurement, not during ethical review of the study that will use it — a short standing checklist applied to every new tool means a team isn't discovering problems study by study. Worth building in too: an exit plan for how data would actually be extracted if the study needed to switch providers, and a second, independent opinion before committing a meaningful volume of participant data to a long study.
