Cloud service providers should treat a code of conduct as a governance framework, not a shortcut. The practical value is in mapping processing activities, documenting controls, and showing that Article 28 processor duties are consistently applied. A strong code also improves transparency for customers and regulators, which helps buyers evaluate whether the provider is suitable for sensitive workloads and regulated data handling.
What a code of conduct actually proves in a GDPR compliance story
A code of conduct is most useful when it turns vague privacy claims into a repeatable operating model. For cloud service providers, that means showing how processing is governed, how Article 28 processor obligations are implemented in practice, and how the provider can evidence consistency across customers, regions, and services. It is a trust signal only when backed by controls, records, and accountability.
That is why the document has to sit inside the provider’s wider compliance and assurance structure, not outside it. A strong code should align with documented processing, contract terms, review cycles, and control ownership so that customers and regulators can trace what the provider does, not just what it says it intends to do. The value is in demonstrable discipline, not branding.
How providers should structure the code around processing, control evidence, and transparency
At a minimum, the code should describe the provider’s processing role, the boundaries of responsibility, and the internal controls used to support that role. That includes how customer data is handled, which subprocessors are used, how access is governed, how security obligations are assigned, and how exceptions are approved. The more clearly these obligations are mapped, the easier it is to test whether compliance is real.
Providers should also make the code useful for audit and procurement decisions. Buyers need to see whether the provider can support regulated workloads, whether the assurance statement is current, and whether the provider’s practices are stable enough to rely on over time. Independent references such as the EU General Data Protection Regulation (GDPR) and ISO/IEC 27001:2022 Information Security Management help anchor that message in recognised compliance and control language.
For cloud providers, the practical test is whether the code can be used to support due diligence. That often means pairing the code with evidence of access governance, logging, incident handling, supplier oversight, and security accountability. Frameworks such as the CSA Cloud Controls Matrix and SOC 2 Trust Services Criteria (AICPA) are useful because they translate governance claims into control domains customers can compare.
Why compliance teams should treat the code as evidence, not decoration
A code of conduct only helps if it is tied to actual operating evidence. In practice, that means policy-to-control mapping, review records, access decisions, incident records, and proof that commitments are applied consistently across services rather than selectively for sales conversations. If those records do not exist, the code becomes a statement of intent with little regulatory weight.
That is also why cloud providers should avoid writing the code as a legal summary alone. A useful code highlights how processor duties are operationalised: minimisation, security of processing, subprocessor oversight, and customer transparency. The point is to make assessment easier for customers and regulators, not to create a standalone compliance narrative disconnected from delivery reality. For control depth, many providers also map the code against the ISO/IEC 27002:2022 Information Security Controls and CIS Controls v8.
When the code is maintained well, it supports procurement, regulatory engagement, and internal governance at the same time. When it is stale, generic, or detached from controls, it creates a false sense of assurance and weakens trust instead of strengthening it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.28 — Processor | Cloud providers must evidence processor duties under Article 28. |
| Art.30 — Records of Processing Activities | A code of conduct is stronger when aligned to processing records and scope. | |
| Art.32 — Security of Processing | The code should reflect security measures that protect customer data in practice. | |
| Recommendation — Map processing roles and processor duties to documented controls and customer-facing evidence. Maintain accurate processing records to support the code and auditability. Align the code with implemented security measures and evidence of operation. | ||
Practitioner Guidance
What to prioritise: Build the code around the provider obligations that can be evidenced, especially processing scope, security responsibilities, subprocessor governance, and customer transparency. If a statement cannot be tied to a real control, review record, or contract commitment, it should not be relied on as compliance evidence.
What to verify: Check that the code matches the provider’s actual operating model across products and regions, and that it is kept in sync with security controls, customer terms, and audit materials. The common mistake is treating the code as a one-time publication rather than a maintained governance artefact.
Practitioner takeaway: The code of conduct should make GDPR compliance easier to prove, not merely easier to claim; the strongest versions translate legal duties into repeatable controls that customers and regulators can test.
Related resources from NHI Mgmt Group
- When does a service account become a compliance problem?
- How should security teams use infrastructure as code to support SOC 2 compliance in cloud environments?
- How should security teams prioritise NHI remediation in cloud environments?
- How should security teams govern non-human identities for compliance?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 21, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
