Cloud computing and law

Abstract

This article analyzes the shift from traditional technological outsourcing to cloud computing in the Chilean financial sector, as well as the new legal framework governing such migration. Based on the regulations issued by the Financial Market Commission (chapters 20-7 and 20-10 of the Updated Compilation of Banking Regulations) and on Laws 19,628 (as amended in 2024) and 21,663 on cybersecurity, the study examines the enabling requirements, risk assessments, and data protection impact assessments that must precede the outsourcing of critical services to cloud platforms, which are managed in highly concentrated markets by major technology companies. The article also addresses the debate on data territorialization and infrastructure localization, drawing on the opinions issued by the National Economic Prosecutor’s Office and the Competition Tribunal regarding territoriality clauses in cloud services provided to the State. Finally, it examines the liability regime and statutory joint and several liability established in Article 15 bis of Law 19,628 between banks acting as data controllers and cloud providers acting as processors, with particular emphasis on cybersecurity breach scenarios and the significant operational and sanction-related costs involved. The central hypothesis argues that migration to the cloud without due diligence in cybersecurity and data protection gives rise to a complex framework of administrative and civil liabilities for financial institutions and their service providers.