Question ID: 2277
Regulation Reference: (EU) No 2015/35 - supplementing Dir 2009/138/EC - taking up & pursuit of the business of Insurance and Reinsurance (SII)
Topic: Outsourcing
Article: EIOPA-BoS-20-002 Guidelines on outsourcing to cloud service providers(16 and 36 of EIOPA-BoS-20-002 Guidelines on outsourcing to cloud service providers; Article 274(4) (k) and (l) of Commission Delegated Regulation (EU) 2015/35)
Status: Final
Date of submission: 09 Apr 2021
Question
In cases where the undertaking outsources operational activities to service providers which are not cloud service providers but rely significantly on cloud infrastructures to deliver their services (for example, where the cloud service provider is part of a sub-outsourcing chain) , the undertaking has to conclude a written agreement also with the first cloud service provider in the outsourcing chain?
Background of the question
Paragraph 36 of the Guidelines mentiones the respective rights and obligations of the undertaking and of the cloud service provider should be clearly allocated and set out in a written agreement. In the case of service providers which are not cloud service providers but rely significantly on cloud infrastructures it is unclear if the written agreement with this service provider (covering all the aspects of the Guideline, including outsourcing chain) is assimilated to the written agreement with the cloud service provider or it is needed another specific agreement with the cloud service provider.
EIOPA answer
The guidelines do not imply an obligation for the undertaking to conclude a written agreement with the cloud service provider in the outsourcing chain, but to ensure that the content of the guidelines are complied with also in case of this type of arrangements. This expectation is to be read in conjunction with “Article 274(4) (k) and (l) of Commission Delegated Regulation (EU) 2015/35 of 10 October 2014”.