Danyella Marques (Masters in Law and Informatics from the School of Law of the University of Minho & Privacy Lawyer)
I. Introduction
On 20 October 2026, a data centre hosting one of Google Cloud’s zones in the United Kingdom (“UK”) suffered an external electrical power disruption. Workloads in that zone became unavailable. According to Google, the main impact took 6 hours and 8 minutes to resolve.[1]
The effects reached far beyond Google. Services used every day in the UK, including banking services, were affected.[2] And because many companies now provide their services across borders, an incident of this kind can easily reach customers in other countries, including in the European Union (“EU”).
The episode is a reminder of something easy to forget when everything works: a large part of Europe’s economy, and of citizens’ daily lives, now runs on the infrastructure of a small number of third-party cloud providers. This post looks at that dependence, at the security and data protection vulnerabilities that come with it, and at how EU law currently responds to such scenario.
II. A connected economy built on someone else’s infrastructure
Organisations adopt cloud computing to transfer certain responsibilities to providers, to focus on their core business and, increasingly, to help them meet their own regulatory obligations. The literature calls this trend “Compliance as a Service”, in which “customers are becoming increasingly reliant on cloud providers to help them manage specific data protection compliance obligations”.[3] Providers can often offer security that smaller organisations could not achieve alone.
In a 2009 study, ENISA, the EU’s cybersecurity agency, identified several benefits of cloud computing, including economies of scale, faster updates, dynamic scaling of resources and the concentration of resources, which lowers the cost of physical control and security processes.[4] Users no longer maintain physical infrastructure and can reach their data from anywhere with an internet connection.
That concentration has a reverse side. As Johan David Michels and Ian Walden put it, “[m]odern society relies heavily on network and information systems, including cloud services”, and “[a]s individuals and organizations increasingly rely on cloud services for everyday activities, the security of those services becomes a matter of increasing public interest”.[5]
Dependence is also layered. Cloud services often combine hardware and software from different suppliers, or stack interdependent cloud services on top of one another. W. Kuan Hon et. al give the example of Netflix: although customers see it as a streaming service, Netflix operates it on Amazon’s infrastructure, which means that Netflix is both a customer and a cloud service provider. Consumers often do not know how a service is arranged or how many providers sit behind it, which makes it harder to assess risks and to know whom to hold responsible.[6]
Dependence does not stop at the company, either. When organisations rely on a few large providers, individuals end up relying on them too, usually without knowing it. A person paying with a banking app has no contract with the bank’s cloud provider and no way of assessing its resilience, yet a failure from that provider can leave them temporarily unable to access their own money.[7]
The October 2026 outage shows this chain at work. A power failure in a single data centre zone in the United Kingdom[8] reached banking apps used by individuals.[9] The banks’ customers had no contract with Google, yet they depended on it.
III. Where the vulnerabilities lie
Information security is usually described in terms of three properties: confidentiality, integrity and availability.[10]Confidentiality involves protecting data from access by third parties who do not have the appropriate privileges.[11]Integrity refers to protecting data from unauthorised destruction, loss, or modification.[12] Availability encompasses protection against service interruptions and ensuring access to and use of the data.[13] The Google outage was a failure of the third.
ENISA has identified cybersecurity challenges specific to cloud services, including access control, auditing, authorisation, availability, the chain of trust and accountability, compliance, confidentiality, incident management, identification and authentication, integrity, multi-tenancy, network security, privacy, storage, and transparency.[14]Several of them explain why a single failure spreads so far. Availability requires coordination among multiple suppliers and infrastructures to keep a service running end to end. The chain of trust and accountability is spread across several organisations. In multi-tenant environments, one compromised environment can expose others sharing the same infrastructure. And users enjoy little transparency or visibility over the applications, data and interfaces that underpin a service.
Not all incidents are caused by attacks; many stem from infrastructure failures or human error. The Cloud Security Alliance’s 2025 analysis of real incidents found misconfiguration, weak access controls and insecure third-party resources among the most common threats.[15]
Google’s own account of the incident shows that no attack was involved. The root cause was a combination of an external cable fault, a facility operating in a temporary maintenance configuration, and a configuration error in the system that should have started the backup generators.[16] Recent history confirms that such risks are recurrent. In March 2021, a fire at an OVHcloud data centre in Strasbourg left millions of websites offline, including government portals, banks and shops.[17] In December 2021, a disruption on Amazon’s cloud services, caused by problems with network equipment resulting in widespread errors, affected millions of users and businesses in the United States, including Netflix and Disney+, as well as Amazon’s own services.[18] On 10 September 2024, a fire caused by exploding lithium batteries at an Alibaba Cloud data centre in Singapore disrupted cloud services.[19]
What distinguishes the cloud from traditional IT outsourcing, Gleeson and Walden note, is a “greater loss of control by the cloud user”, combined with control delegated across layers of providers, “often opaque to any one of them”.[20]ENISA also observes that the massive concentration of data makes cloud environments more attractive to attackers, even if cloud-based defences can be more robust.[21]
IV. How EU law responds
The EU has built several layers of rules that touch on cloud dependence, each with a different focus.
The first is data protection. The General Data Protection Regulation (“GDPR”) does not regulate cloud services as such, but its security obligations apply fully to them whenever they process personal data within its scope. Article 32 requires appropriate technical and organisational measures, including the resilience of systems and the ability to restore availability and access to personal data in a timely manner after an incident. Articles 33 and 34 require personal data breaches to be notified to the supervisory authority within 72 hours and, where the risk is high, to the data subjects.[22]
The second is cybersecurity. The NIS2 Directive, which replaced the 2016 NIS Directive, includes cloud service providers within its scope, with the largest of these being classified as essential entities.[23] They must adopt risk management measures covering, among other things, incident handling, business continuity and supply chain security, and must report significant incidents. NIS2 also requires entities to consider the vulnerabilities of each direct supplier and the cybersecurity practices of their providers.[24]
The third addresses dependence from the angle of the market. If a customer cannot leave a provider, concentration becomes lock-in. The Data Act requires cloud providers to allow customers to switch to another provider, or back to on-premises infrastructure, without technical, contractual, commercial or organisational obstacles, and to offer open interfaces and data export in machine-readable formats.[25] From 12 January 2027, providers may no longer charge customers for switching.[26] The Commission’s cloud strategy points the same way, recommending hybrid and multi-cloud approaches that avoid exclusive reliance on a single supplier.[27]
Finally, the financial sector has its own layer of oversight. On 21 October 2026, the day after the outage, Europe’s financial regulators questioned Google about it, which suggests that supervision now reaches the provider itself, not only the banks that use it.[28] This concern is not new. Since 17 January 2025, the Digital Operational Resilience Act (“DORA”) is effective across the EU to help financial entities withstand, respond to and recover from Information and Communication Technology (“ICT”) disruptions.[29] Under this framework, in November 2025, the European Supervisory Authorities (EBA, EIOPA and ESMA, “the ESAs”) designated a number of technology providers, including major cloud players as critical ICT third-party providers, bringing them under direct EU oversight.[30]
Even the most comprehensive regulation is unlikely to prevent every incident. Power failures, configuration errors and faulty updates may still occur, even in the most robust infrastructures. What increasingly matters is how organisations prepare for these events and how they respond to them. This includes the preventive measures they can show are in place and the steps they take to restore services and prevent the problem from recurring. Google’s incident report is an example of this kind of transparency, as it not only explains the root cause but also sets out the corrective measures taken.[31]Resilience, rather than the mere absence of incidents, is now the focus of attention.
V. Conclusion
Nothing in Google’s report suggests that the October 2026 outage involved a data breach. It was nonetheless a security event in the full sense, which encompassed a failure of availability that began with a power fault in one data centre and spread to banks and their customers. It shows that cloud dependence is no longer a private matter between a company and its supplier. It is a question of public interest.
As discussed above, EU law has been increasingly addressing this area. The GDPR addresses security and makes resilience part of data protection, NIS2 brings cloud providers and supply chains under cybersecurity supervision, and the Data Act tries to keep the market open by making switching possible. DORA addresses the digital resilience of financial entities and goes further still by bringing certain critical providers under direct supervision.
Nevertheless, no system is entirely immune to incidents. The October outage shows that a single point of failure can reach people far beyond the provider’s own customers. The real test for providers and their customers is resilience, being able to show what they did to prevent an incident and how they recovered from it. This approach can help Europe make the most of the cloud while giving citizens greater confidence in the infrastructures they depend on.
[1] Google Cloud, “Multiple services were experiencing issues in the europe-west2 region,” Google Cloud Service Health, incident report updated October 27, 2026, accessed November 8, 2026, https://status.cloud.google.com/incidents/Xs2XTHzAVC9YnafnPyzj.
[2] Phoebe Seers and Elizabeth Howcroft, “Europe’s financial regulators query Google over cloud outage that hit banks,” Reuters, October 21, 2026, accessed November 8, 2026 https://www.reuters.com/business/finance/europes-financial-regulators-query-google-over-cloud-outage-that-hit-banks-2026-10-21/.
[3] Christopher Millard (ed.), Cloud Computing Law, 2nd ed. (Oxford: Oxford University Press, 2021), 338. See also Dimitra Kamarinou, Christopher Millard and Isabella Oldani, “Compliance as a Service,” Queen Mary School of Law Legal Studies Research Paper No. 287/2018 (2018), accessed November 8, 2026 https://ssrn.com/abstract=3284497.
[4] ENISA, Cloud Computing: Benefits, Risks and Recommendations for Information Security (ENISA, November 20, 2009), accessed November 8, 2026, https://www.enisa.europa.eu/publications/cloud-computing-risk-assessment.
[5] Johan David Michels and Ian Walden, in Millard, Cloud Computing Law, 382.
[6] W. Kuan Hon, Christopher Millard and Jatinder Singh, in Millard, Cloud Computing Law, 18–20.
[7] Anhata Rooprai, “Google Cloud outage in UK eases after impacting digital banks, public sector websites,” Reuters, October 20, 2026, accessed November 8, 2026 https://www.reuters.com/world/europe/google-cloud-services-experience-outage-europe-2026-10-20/.
[8] Google Cloud, “Multiple services were experiencing issues in the europe-west2 region.”
[9] Rooprai, “Google Cloud outage in UK eases after impacting digital banks, public sector websites.”
[10] NIST, “Information security,” Computer Security Resource Center – Glossary, accessed April 13, 2025, accessed November 8, 2026 https://csrc.nist.gov/glossary/term/information_security.
[11] Millard, Cloud Computing Law, 33.
[12] Millard, Cloud Computing Law, 42.
[13] Millard, Cloud Computing Law, 43.
[14] ENISA, Cloud Cybersecurity Market Analysis (ENISA, March 2023), accessed November 8, 2026, https://www.enisa.europa.eu/sites/default/files/publications/Cloud%20Cybersecurity%20Market%20Analysis.pdf.
[15] Cloud Security Alliance, Top Threats to Cloud Computing – Deep Dive 2025 (CSA, April 28, 2025), accessed November 8, 2026, https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-2025.
[16] Google Cloud, “Multiple services were experiencing issues in the europe-west2 region.”
[17] Mathieu Rosemain and Raphael Satter, “Millions of websites offline after fire at French cloud services firm,” Reuters, March 10, 2021, accessed November 8, 2026, https://www.reuters.com/article/us-france-ovh-fire-idUSKBN2B20NU/.
[18] Giles, M., “A major outage at AWS has caused chaos at Amazon’s own operations, highlighting cloud computing risks”, Forbes, December 7, 2021, accessed November 8, 2026, https://www.forbes.com/sites/martingiles/2021/12/07/aws-outage-caused-chaos-at-amazon-underlining-cloud-computing-risks/.
[19] Alibaba Cloud, “[Exception (recovered)] Fire incident in Singapore Availability Zone C Data Center,” Alibaba Cloud Status, accessed November 8, 2026, https://status.alibabacloud.com/#/eventDetail?eventId=21.
[20] Niamh Gleeson and Ian Walden, in Millard, Cloud Computing Law, 506.
[21] ENISA, Cloud Computing: Benefits, Risks and Recommendations for Information Security.
[22] Articles 32 to 34 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, accessed November 8, 2026, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng.
[23] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS2 Directive), OJ L 333, 27.12.2022, accessed November 8, 2026, https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng.
[24] Article 21(2) and (3) of the NIS 2 Directive.
[25] Articles 23, 25 and 30 of Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act), OJ L, 2023/2854, 22.12.2023, accessed November 8, 2026, https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng.
[26] Article 29 of the Data Act.
[27] European Commission, “Cloud computing,” Shaping Europe’s Digital Future, accessed November 8, 2026, https://digital-strategy.ec.europa.eu/en/policies/cloud-computing.
[28] Seers and Howcroft, “Europe’s financial regulators query Google over cloud outage that hit banks.”
[29] European Insurance and Occupational Pensions Authority (EIOPA), “Digital Operational Resilience Act (DORA),” accessed November 8, 2026, https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en.
[30] European Banking Authority, “The European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience Act,” press release, November 18, 2025, accessed November 8, 2026, https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital.
[31] Google Cloud, “Multiple services were experiencing issues in the europe-west2 region.”
Picture credit: by panumas nikhomkhai on pexels.com.
