Using the cloud for data migration: practical issues and legal implications

Web services provider Postcode Anywhere shares its experiences of cloud computing with IT law expert Jagvinder Kang

The hype about cloud computing is everywhere so it is important to distinguish between the perceived benefits, actual benefits and associated risks.

Cloud computing has been around for years, albeit in different guises, but the technology has now allowed it to gather sufficient momentum to allow greater flexibility and versatility - a fact echoed by Guy Mucklow, the managing director of Postcode Anywhere.

Postcode Anywhere, which offers web services and software to look up UK and international addresses, has been using the cloud for several years in its service offerings and its latest use is its MyServices suite of cloud service offerings, which can be used to facilitate data migration between legacy and replacement systems through the cloud.

"The internet provides an ideal medium for managing data between distributed systems compared to traditional EDI [electronic data interchange] methods. This allows data to be more easily moved between different systems and platforms at a much lower cost than has historically been the case," says Mucklow.

"We've seen the cloud evolve over the last 10 years and realised from an early stage that the use of web technologies makes it easier to access different systems. One of our core focuses has always been delivering data anywhere - to any software on any device anywhere in the world. We started with postal data but we realised that the same technology can be used by our customers to make their own data available anywhere and, crucially, make it easy to share and move it around."

Using the cloud for data migration

Traditionally, one-off batch cleansing jobs have been used to move data from one system to another, in what can be complex and expensive tasks. However, this is starting to change. With communication historically at the heart of internet technologies, the cloud offers a convenient way to connect systems together. In particular, it allows a phased, rather than "big bang" approach to data migration, which can be achieved incrementally and in near real-time.

So what are the other benefits of using the cloud for data migration?

First, it is far easier to manage data across physically different customer sites - even across the globe. Second, the cloud bridges the gap where systems are different. For example, migrating data from an onsite premises CRM system to Salesforce.com.

In reality, the future of cloud data management is in data virtualisation, enabling "migrations" to become more agile and responsive than traditional methods. This can involve, for instance, allowing accounts to be accessed through Salesforce.com, while keeping the data in Sage. This avoids uploading all the data in a one-off operation, by allowing the data to reside in Sage, while virtualising it in Salesforce.com, to provide real-time benefits and liberate the data.

Postcode Anywhere, for example, says its MyServices technologies enable customers to move data into and out of Salesforce CRM instantly. It says this makes it easier to share information across systems without the risk of multiple copies getting out of date.

Database managers need to do more than transfer data from yesterday's silo to today's. In this context, Sage data for example, when used by an accounts team, can be accessed in real-time by the support team through their CRM system, while engineers can also access it through their iPhones and synchronise it offline. The cloud offers true flexibility in this respect.

Cloud-based data platforms allow a more comprehensive view of data, which addresses a requirement of users wanting more data in more places than before. As the adoption of cloud technologies increases, we will start to see a plethora of mobile, handheld, office, home, and leisure devices hooked into central repositories of data stored securely in the cloud and served out virtualised. In this sense, it's a misnomer to refer to data migration in the cloud - it's really data ubiquity.

Legal and business considerations

It is important to be alive to the legal and business risks of cloud computing in the context of data migration. Without considering and addressing the implications of these, the cloud strategy of a business will be seriously flawed. So what are some of the key legal and business issues?

Using the cloud for data migration: practical issues and legal implications

Web services provider Postcode Anywhere shares its experiences of cloud computing with IT law expert Jagvinder Kang

Data protection issues

Compliance with data protection legislation is key to organisations where personal data is involved, with the fallout of non-compliance being both legal ramifications (together with the prospect of heavy fines from the Information Commissioner's Office), as well as the adverse publicity.

From a data protection perspective, the cloud service provider will be acting as a data processor in relation to the customer's organisation, so it is important that appropriate safeguards are included in the contract, especially to deal with the seventh and eighth principles of the Data Protection Act, namely: (1) ensuring that appropriate technical and organisational measures are taken against unauthorised or unlawful processing of personal data, and against accidental loss or destruction of personal data; and (2) ensuring that personal data is not transferred outside the European Economic Area, unless that country ensures an adequate level of protection. This is therefore particularly important if the service provider is intending to use servers in the US or India, for example.

Data protection legislation is concerned with personal data. It's important not to lose sight of the non-personal data that a customer makes available, which might nevertheless be confidential, and therefore needs appropriate security safeguards.

There needs to be clear obligations on both the customer and the service provider, with an appropriate delineation of responsibilities. In addition, there needs to be accurate field mapping details to allow data transfer from one database to another. Responsibility for addressing these issues needs to be clear.

Pilot runs, data integrity and interruption

The issue of verifying the data integrity of the converted data, together with the ability to "unwind" a migration if there are migration problems should be discussed upfront from a practical perspective, with appropriate provisions being included in the contract. The cloud and the underlying internet infrastructure also mean that there could be data flow interruptions, so the implications and consequences of this should be addressed too.

Before transferring a large amount of data from one database to another, it's prudent to have an initial pilot run. This can minimise the risk of data corruption issues.

Client-side backup, business continuity and disaster recovery considerations

Data migration, in our example, involves accessing existing legacy systems so it's important that the customer maintains their own internal backups, business continuity and disaster recovery measures, in case it does not go as planned. This will help mitigate against data and financial loss.

Mucklow comments: "The cloud does present challenges, where things can go wrong. Connectivity could fail half way through, rogue data may cause problems or other unforeseen issues come into play. The vital thing to do is log the changes and be prepared to undo them quickly and easily where there are problems. This isn't easy to do and a real focus for research at the moment. The great thing is that this isn't a new problem - SQL databases have run with the idea of transactions for years - the challenge is to offer the same features in systems that don't support transaction-like models."

Protection

Both parties need to be clear about their obligations regarding virus and firewall protection, especially since there are both legacy and new systems being accessed by an outside cloud system.

Liability implications

Liability is a contentious issue in contracts. It can become more contentious in cloud arrangements, as one of the advantages of cloud computing is that it can be a relatively low cost service. This usually entails a trade-off with regard to liability arrangements, with a service provider looking to have low liability caps, together with extensive exclusions of liability. This will vary, depending on the type of data being migrated and the value of the contract, but service providers will usually be looking to limit their liability by reference to the value of the contract itself. So customers need to consider whether they want to negotiate greater liability cover at a higher cost of service.

Timing implications

The timing of the cut-over of the data migration from the old to new systems needs to be planned in the project and reflected in the contract, together with the consequences for failure to comply with cut-over dates, and the process for arranging an alternative cut-over.

Conclusion

Cloud computing has moved on considerably from the days of just involving hosting of "vanilla applications". The reality of what can be achieved through the cloud is clearly moving up the value chain. However, all good things come with some risks, and the challenge is to recognise these and address them, so that the advantages of the cloud can be embraced to achieve business value.

"We believe the cloud is coming of age with a transition from early stage, flaky and often free offerings, being replaced with commercial-grade software that offers a real alternative. The greatest opportunity offered by the cloud and products like MyServices is getting the right information to the right person, right on time. It shouldn't matter where it is and it shouldn't take a 12-month migration project to open it up to the right audience - that's the game-changing opportunity that will make the real difference to those that adopt it," says Mucklow.

"Consistent data is what separates the ordinary business from the successful business. It underpins good customer service and is key to providing the intelligence that puts a business ahead of its competitors. Where the cloud can help is in providing the glue to help ensuring a single, consistent view between data held in disparate systems."

Jagvinder Kang is director of the Technology Law Alliance