PI · Portability and Interoperability
PI-02 Contractual Agreements for the Provision of Data
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Realigned criterion to be about the provisioning of cloud service customer data, not just the provisioning after the termination of the contractual relationship.
Extended the aspects to be defined in contractual agreements by the delivery methods of the data, the right of contract termination, and the cloud service customer data remaining the property of the cloud service customer throughout the contractual relationship.
Specified requirements regarding conditions and time frames for the provisioning of cloud service customer data to be applicable throughout the entire duration of the contractual relationship.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Added requirement regarding the provision of cloud service derived data upon contract termination.
Wording in C5:2020
Basic criterion
In contractual agreements, the following aspects are defined with regard to the termination of the contractual relationship, insofar as these are applicable to the cloud service:
- Type, scope and format of the data the Cloud Service Provider provides to the cloud customer;
- Definition of the timeframe, within which the Cloud Service Provider makes the data available to the cloud customer
- Definition of the point in time as of which the Cloud Service Provider makes the data inaccessible to the cloud customer and deletes these; and
- The cloud customers' responsibilities and obligations to cooperate for the provision of the data.
The definitions are based on the needs of subject matter experts of potential customers who assess the suitability of the cloud service with regard to a dependency on the Cloud Service Provider as well as legal and regulatory requirements.
Additional criterion
The design of the aspects is based on legal and regulatory requirements in the environment of the Cloud Service Provider. The Cloud Service Provider identifies the requirements regularly, at least once a year, and checks these for actuality and adjusts the contractual agreements accordingly.
Supplementary information on all sub-criteria
The type and scope of the data and the responsibilities for its provision depend on the service model of the cloud service or the services and functions provided:
In the case of IaaS- and PaaS-like services, the cloud service customer is generally responsible for extracting and backing up the data which is stored in the cloud service before termination of the contractual relationship (cf. complementary requirement).
The cloud service provider's responsibility is typically limited to the provision of data for the configuration of the infrastructure or platform that the cloud service customer has set up within its environment (e.g. configuration of networks, images of virtual machines and containers).
With SaaS, the cloud service customer typically relies on export functions provided by the cloud service provider. Data created by the cloud service customer should be available in the same format as stored in the cloud service. Other data, including relevant log files and metadata, should be available in an applicable standard format, such as CSV, JSON or XML.
Legal requirements can, for example, include the EU Data Act. In Germany, legal requirements for retention in particular can be found, for example, in the German Tax Code (§147 AO) and the German Commercial Code (§257 HGB). These provide for a retention obligation of six or ten years.
If contractual agreements do not include the aspects listed in the basic criterion, and these are applicable due to the service model, the criterion is not met and a deviation is to be noted by the auditor.
Basic criterion
In contractual agreements, the following aspects are defined for provisioning of cloud service customer data following termination of the contractual relationship, insofar as these are applicable to the cloud service:
- Type, scope and format of the cloud service customer data the cloud service provider provides to the cloud service customer;
- Methods for delivering the data to the cloud service customer;
- Conditions and time frames for cloud service customer data provisioning throughout the duration of the contractual relationship;
- Right of termination of the contract and definition of the time frame within which the cloud service provider makes the cloud service customer data available to the cloud service customer after termination of the contract;
- Definition of the point in time as of which the cloud service provider makes the cloud service customer data inaccessible to the cloud service customer and deletes these after termination of the contract;
- The cloud service customers' responsibilities and obligations to cooperate for the provision of the cloud service customer data; and
- Cloud service customer data remains the property of the cloud service customer throughout the entire contractual relationship. After its termination, the data is once again the sole property and possession of the cloud service customer.
The definitions are based on the needs of subject matter experts of potential customers who assess the suitability of the cloud service with regard to a dependency on the cloud service provider as well as legal and regulatory requirements.
Supplementary information
If the cloud service provider acts as a cloud service broker, special consideration should be given to contractual data-portability clauses that recognise the complexity of the particular cloud service broker scenario. This can include, but is not limited to, the definition of:
- Responsibility for the export of cloud service customer data;
- If there are multiple underlying cloud service providers, the export scope, the consolidated format, any completeness limits, and how cloud service broker generated artifacts such as aggregated logs are handled;
- Whether cloud service customers can access the cloud services of underlying cloud service providers directly via APIs or have to rely on the cloud service broker's export interface, and whether there are any timing or usage restrictions; and
- Time frames for the delivery of cloud service customer data exports to the cloud service customer.
Additional criterion
PI-02.01AC
Additional, complementingThe design of the aspects is based on legal and regulatory requirements in the environment of the cloud service provider. The cloud service provider identifies the requirements regularly, at least once a year, and checks these for actuality and adjusts the contractual agreements accordingly.
PI-02.02AC
Additional, complementingThe cloud service provider also provides cloud service derived data to the cloud service customer upon termination of the contractual relationship. The provision of this data is also defined in the contractual agreements and includes the aspects specified in the basic criterion.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the data to which they are contractually entitled is requested from the cloud service provider at the end of the contract or accessed via defined interfaces (the type and scope of the data correspond to the contractual agreements that were concluded prior to the use of the cloud service) and that it is stored in accordance with the legal requirements applicable to this data.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources