Switching of Cloud Services Providers : executive summary.
Date: 2018-05-08
Institutions: Directorate-General for Communications Networks, Content and Technology
Subjects: Internet access provider, broadcasting, communications systems, computer network, goods and services, information technology, regulation (EU), regulation of telecommunications, services contract, telecommunications, telecommunications industry

Switching of Cloud Services Providers 

EXECUTIVE SUMMARY 

A study prepared for the European Commission 

DG Communications Networks, Content & Technology by: 

 
 
 
 
 
 
 
 
 
 
 
Switching of Cloud Services Providers 

This study was carried out for the European Commission by IDC and Arthur’s Legal. 

Authors: Douglas Hayward (IDC), George Mironescu (IDC), Gabriella Cattaneo (IDC), Stefania Aguzzi 
(IDC), Arthur van deer Wees (Arthur’s Legal), Dimitra Stefanatou (Arthur’s Legal) 

Internal identification 

Contract number: 30-CE-0830436/00-39  

SMART number 2016/0032 

DISCLAIMER 

By  the  European  Commission,  Directorate-General  of  Communications  Networks,  Content  & 
Technology.  

The information and views set out in this publication are those of the author(s) and do not necessarily 
reflect the official opinion of the Commission. The Commission does not guarantee the accuracy of the 
data included in this study. Neither the Commission nor any person acting on the Commission’s behalf 
may be held responsible for the use which may be made of the information contained therein. 

ISBN 978-92-79-77790-5 

doi: 10.2759/774982 

© European Union, 2018. All rights reserved. Certain parts are licensed under conditions to the EU.  

Reproduction is authorised provided the source is acknowledged.  

2 

 
 
 
 
 
 
 
 
 
Executive summary  

This  is  the  Executive  Summary  of  the  Final  Report  of  the  study  "SMART  2016/0032  –  Switching  of 
Cloud  Services  Providers"  entrusted  by  the  European  Commission  DG  CONNECT  to  IDC  and 
Arthur’s Legal. 

This  study  collected  evidence  on  practices  relating  to  switching  of  cloud  services  providers  and 
analysed in depth the barriers potentially preventing data and/or application portability, as well as the 
policy  measures  needed  to  overcome  these  barriers.  The  conclusions  and  recommendations  of  the 
interim report of this study, as well as the input collected at the workshop that took place on 18 May 
2017  in  Brussels, contributed to the Impact Assessment of the  proposed regulation  on  a framework 
for  the  “Free  flow  of  non-personal  data  in  the  European  Union”1,  published  by  the  European 
Commission in September 2017. 

In this study portability was defined as follows: 

‘Data portability is the ability to easily transfer data from one cloud service provider to another cloud 
service  provider  without  being  required  to  export  and  re-import  the  data;  similarly,  application 
portability  is  the  ability  to  easily  transfer  an  application  or  application  components  from  one  cloud 
service to a comparable cloud service and run the application in the target cloud service’.  

Note that  portability of data may,  also, refer to  the  portability  of data to the cloud customer’s own  IT 
systems; the latter option does not fall directly, though, under the scope of the present study. 

The Cloud Market Context 
Uncertainty  about  data/application  portability  between  different  cloud  providers  is  a  barrier  currently 
preventing many cloud users from increasing their use of public cloud and “going up the stack”, which 
means  investing  in  more  sophisticated  services  or  applications.  This  concern  was  shared  by 
approximately 25% of the respondents to IDC’s annual Cloud  View Enterprise Survey  and confirmed 
by the case studies and interviews carried out by this study.   

Another factor driving the need for a policy intervention in portability is the increasing concentration of 
the public cloud market in Europe. The top 5 public cloud providers increased their collective market 
share  from  22%  in  2013  to  31%  in  2016,  while  the  top  10  providers  control  39%  of  the  market, 
according  to  IDC  data.  Considering  only  the  public  cloud  platform services market  (IaaS  plus  PaaS) 
the share of the top 5 Cloud Service  Providers  (from now on CSPs)  was already  over 50%  in 2016, 
with  increasing  dominance  of  the  top  3  CSPs.  While  the  SaaS  market  is  consolidating  but  still 
maintains a plurality of suppliers, the IaaS and  PaaS market is at risk of becoming an oligopoly of a 
less than handful of providers.  

These  trends  may  further  reduce  the  market  power  of  cloud  users  in  their  contractual  relationships 
with providers and increase the risks of customers’ lock-in, providing grounds for a counterbalancing 
policy action guaranteeing portability.  

1 Brussels, 13.9.2017, COM(2017) 495 final, 2017/0228 (COD) 

 
                                                      
The Main Data and Application Portability Challenges 
The key findings of this study show that irrespective of the size of an organization, cloud portability is 
likely to be hindered by technical, economic/financial and legal challenges, given the current maturity 
of cloud services users across the EU. However, the  ability to  overcome the various challenges that 
are linked to data portability and application portability is related to the combination of multiple factors; 
for instance:  

1. 
2. 

3. 

4. 

the service model (IaaS, PaaS and/or SaaS),  
the complexity, quality and quantity of the data, data architecture, various data formats, data 
portability interfaces and data transfer rate,  
 the specification of the associated Service Level Objectives (SLOs) under the Service Level 
Agreement  (SLA)  concluded  between  the  Cloud  Service  Provider  (CSP)  and  the  Cloud 
Service Customer (CSC)   
the size and buying power of the cloud service customer.  

Parity between data formats emerges as one important and complex barrier to data portability. Cloud 
users often need to invest in tools or services to re-process exported data and reformat the data to fit 
into  the  formats  used  by  the  cloud  vendor  to  which  they  are  migrating.  The  low  levels  of  parity 
between the services provisioned by cloud vendors (often the result of conscious attempts by vendors 
to differentiate their services in a competitive environment)  can potentially increase exponentially the 
technical challenges faced by end users when seeking to port data from one cloud provider to another. 
It is therefore particularly important that cloud vendors be transparent about their data formats.   

Besides  the  issues  related  to  data  formats,  the  physical  movement  of  data  –  particularly  in  large 
quantities - can be another notable inhibitor to data portability. Network bandwidth can be costly when 
customers are porting their data from a cloud service provider, as transferring very large datasets may 
take  a  long  time  or  be  unfeasible  over  internet  connections.  Organizations  may  find  that  they  are 
offered significantly lower bandwidth speeds for extracting their data than the one they are offered for 
putting their data into the cloud service. 

From a legal standpoint, there is a series of legal issues emerged  from the field research carried out 
by the study team, which can be summarized as follows:  

1.  Absence of an Exit Plan under the contractual agreement between the CSP and the CSC. 
1.  Absence  of  provisioning  of  the  portability  related  attributes  under  the  Service  Level 

Agreement. 

2.  The lack of meaningful remedies. 
3.  The  ineffective  or  inconsistent  use  of  standards  that  hampering,  also,  the  wide-spread 

adoption of portability related practices in the market. 

4.  The unwillingness of certain large CSPs to cooperate with CSCs. 

For large organizations, the technical, financial/economic and legal challenges emerging during cloud 
migration projects should usually  be surmountable – although at a cost. This is for example because 
larger organizations have sizeable budgets, prior experience of large and complex project migrations, 
as well as the negotiating power to influence the actions of their cloud services providers.  

Small  and  medium  sized  enterprises  (SMEs)  on  the  other  hand,  do  not  necessarily  have  these 
attributes  and  may  therefore  be  deterred  from  attempting  cloud  migrations  because  of  their  limited 

4 

 
resources,  experience  and  negotiating  power.  In  the  cases  where  cloud  migration  is  attempted, 
business  disruption  and  possible  business  discontinuity  can  be  a  serious  risk,  especially  for  SME 
organizations.  Moreover,  the  financial,  and  cyber-security  risks  associated  with  porting  data  may  be 
more difficult to handle for SMEs. 

Cost analysis of cloud portability  
The study carried out a detailed analysis of the costs of cloud portability in 3 anonymized use  cases. 
As shown in the figure below, the typology of costs is articulated in the 3 main phases of the contract 
life-cycle  (preparation,  execution  and  termination),  and  includes  data  egress  costs,  transport  fees, 
human  resources  costs.  The  costs  resulting  from  the  use  cases  (which  are  only  indicative  and  are 
based  on  a  set  of  assumptions  about  the  typology  of  services  and  the  circumstances  of  switching) 
range widely from approximately €18.800 in a simple case of data portability, to €119.400 in a medium 
complex  case,  to  €231.400  for  a  highly  complex  case.  This  however  excludes  the  termination  costs 
including the costs of downtime and concurrent cloud use, which may create business disruption and 
be particularly heavy.  

Comparing  the  switching  costs  to  the  annual  estimated  costs  for  a  cloud  subscription  in  the  same 
case, it appears that they represent 125% of annual costs in the simple case, 100% of annual costs 
for the medium complex case, and only 40% for the complex case. In other words, for both the simple 
and  medium-complex  cases  the  costs  of  switching  are  comparatively  high  so  that  companies  will 
probably think long and hard before making this decision. With regards to the complex case, the costs 
are lower compared the cost of annual subscription, but the potential risks due to business disruption 
and unforeseen complexities are difficult to evaluate.  

Policy Scenario 
Building  on  the  analysis  of  the  technical,  legal  and  economic  issues  identified,  the  study  team 
considered  and  assessed  a  wide  range  of  potential  policy  measures  in  terms  of  their  impact  on  the 
entire  set  of  cloud  stakeholders.  Based  on  these  considerations,  we  developed  3  potential  policy 
scenarios as follows:   

5 

 
 
1.  A "No EU Policy Action" impact scenario, which leaves relevant actions for portability to the 
Member States, if they are willing to do so, with the risk to increase markets fragmentation and 
therefore hampering the Digital Single Market both at micro and macro level.   

2.  A “Soft Regulation” scenario, which assumes that the European Commission promotes cloud 
portability  by  encouraging  the  adoption  of  self-regulatory  measures,  instead  of  taking  any 
immediate action linked to  the  introduction of a statutory right.  Soft regulation may  involve  –
among  other  things-  supporting  the  wide  adoption  of  the  existing  guidelines  and  codes  of 
conduct  that  provide  in  a  transparent  and  detailed  manner  for  portability  in  the  cloud 
environment; it may, also, encourage taking actions aiming at the consistent use of standards 
and  at  the  performance  of  awareness  campaigns  on  the  relevant  topics  targeting  the  entire 
spectrum of cloud stakeholders including both the demand and the supply side. 

3.  A  "Mandatory  Regulation"  scenario,  which  assumes  the  introduction  at  EU  level  of  a  new 
right  to  portability  of  customer  data  (including  both  personal  and  non-personal  data)  for 
professional users and a new right to portability of applications, building on the data portability 
right  introduced  by the General Data  Protection  Regulation (GDPR) in relation  exclusively to 
personal data.  

Potential economic impacts of the policy scenarios 
The  potential  economic  impact  of  the  policy  scenarios  was  estimated  based  on  an  economic  model 
estimating the growth of public cloud demand under each scenario to the year 2025, measured as the 
variation  of  public  cloud  spending  in  the  EU27  (excluding  the  UK),  leveraging  IDC  data  and  user 
surveys.  Building  on  the  evidence  collected  by  this  study  that  many  cloud  users  are  reluctant  to 
increase  their  use  of  cloud  because  of  fears  of  customer  lock-in  and  concerns  about  portability,  the 
model developed by IDC estimates the potential increase in public cloud uptake enabled by regulation 
and other policy measures overcoming these barriers.  

As shown by the following figure, according to IDC estimates: 

 

 

In  the  "Soft  Regulation  "  scenario,  demand  for  public  cloud  services  in  the  EU  in  2025  is  6.0% 
higher than it is under the "No Action" scenario in 2025. This represents a difference of €3.9 billion 
in public cloud demand for 2025 between the two scenarios.    
In the "Mandatory Regulation " scenario, demand for public cloud services in the EU in 2025 is 
10.9%  higher  than  it  is  under  the  "No  Action"  scenario  in  2025.  This  represents  a  difference  of 
€7.1 billion in public cloud demand for 2025 between the two scenarios.     

While the impact of policy action on demand growth rates is not huge, the absolute value of the market 
increase by scenario is substantial and would provide additional benefits in terms of overall economic 
growth and welfare in Europe.  

There  would  also  be  costs  to market  actors  associated  with  regulatory  action  and  (to  a much  lesser 
extent)  with  non-regulatory  action  by  the  European  Commission,  even  though  they  should  be 
affordable and compensated by additional demand.  

6 

 
 
 
Indeed, the CSPs interviewed for this study made clear that in their opinion compliance costs would be 
acceptable  for  increased  transparency  (for  example  of  data  formats  and  schemes),  but  could  be 
relevant for data and  application  portability (unless standardization  grows faster than expected). The 
CSPs  underlined  that  any  obligation  to  ensure  data  portability  must  be  clearly  defined  and  scope-
limited, otherwise compliance costs would be  "impossibly high" to meet. What is especially feared is 
being obliged to adjust to every single user requirement, which may require an infinite flexibility. This 
worries both large and small CSPs. 

Conclusions 
The study produced an assessment of the potential measures considered appropriate to address the 
issues of portability of data and applications in the cloud, as briefly discussed earlier in the document. 

There  is  a  series  of  soft  law  instruments  currently  available  relevant  for  portability  of  data  in  the 
cloud  environment.  As  far as  those  instruments  are  concerned,  it  is  of  high  relevance  to  stress  that: 
existing  guidelines  created,  specifically,  for  the  cloud  environment  do  provide  detailed  guidance  in  a 
transparent  manner  concerning  portability.  Cloud  Service  Level  Agreement  Standardization 
Guidelines2, for instance, constitute an appropriate and fully-fledged instrument providing, also, for the 
portability of data in the cloud environment. Similarly, available technical standards (e.g. ISO19086) do 
provide  detailed  guidance  to  organizations  in  relation  to  complex  matters  at  the  level  of 
implementation.  The  common  denominator  of  soft  law  instruments  of  is  the  potential  lack  of  “real 
effectiveness’’  due  to  their  voluntary  nature  and  the  related  absence  of  meaningful  redress 
mechanisms. 

he level of commitment to existing soft law instruments appears to be rather low within the EU market. 
Technical  standards  are  not  consistently  used,  while  existing  guidelines  regulating  behavior  in  the 
cloud environment –including in relation to portability practices- do not seem to be widely adopted by 

2  Cloud  Service  Level  Agreement  Standardisation  Guidelines,  available  at:  https://ec.europa.eu/digital-single-
market/en/news/cloud-service-level-agreement-standardisation-guidelines 

7 

 
 
                                                      
market players. 4. Should the engagement of cloud stakeholders to existing soft law instruments was 
encouraged,  their  effectiveness  would  be  substantially  enhanced  and,  thus,  portability  would  be 
addressed sufficiently both at an organizational and at a technical level. 

Taking  into  account  the  policy  options  briefly  discussed  above,  the  most  effective  way  to  lift  the 
barriers to the portability of data and applications in the cloud would be through the introduction of a 
statutory right dictating the portability of data and applications in the cloud that would be applicable 
both for  organizations  and  individuals.  Such right  would enhance clarity  and, thus, legal certainty for 
organization, making them more likely to use cloud services. Currently, portability of data is regulated 
through contractual arrangements, which are subjects to the laws of different Member States, and is 
thus  subject  to  greater  levels  of  complication  and  uncertainty  than  would  be  the  case  if  there  was  a 
harmonized regulatory approach at EU level allowing for portability of non-personal data. 

Regulatory  intervention  would  provide  additional  safeguards  protecting  consumers  and  companies 
from  the  assumption  of  unreasonable  financial  costs,  for  example  preventing  end  users  from  being 
charged  unreasonable  fees  for  taking  their  data  and/or  applications  out  of  a  cloud  service. 
Harmonization  of  the  legal  regime  concerning  portability  of  data  in  the  cloud  environment  would 
enhance  trust  in  the  market,  thus  creating  a  stronger  framework  for  intra-EU  cross-border  trade  and 
encouraging  the  free  flow  of  data.  Furthermore,  a  statutory  right  providing  for  the  portability  of  data 
and  applications  in  the  cloud  could  form  an  appropriate  measure  in  the  context  of  the  rapidly 
consolidating cloud market.   

Technology regulation generally imposes costs on economic actors, and both the Soft Regulation and 
the Mandatory Policy scenarios would impose costs – mostly to be borne by the supply side (the cloud 
services vendors and their ecosystems), although economic theory suggests that these costs will likely 
be passed on to the demand side (enterprises and public bodies) in part or in whole. For cloud service 
providers,  it  is  likely  that  the  additional  costs  would  be  countered  (if  not  entirely  outweighed)  by 
increased  levels  of  demand  for  cloud  services,  and  by  the  opportunity  to  take  market  share  more 
easily from competitors.   

One  argument  against  the  introduction  of  a  compulsory  regulation  is  that  it  might  have  a  retarding 
effect on innovation and on the development of new solutions by providers in the regulated market, by 
introducing  uncertainty  about  compliance,  or  by  lengthening  development  cycles  (as  compliance 
needs  to  be  built  into  offering  development).  Therefore,  it  is  possible  that  regulation  might  impose 
some lengthening of development cycles for new cloud services, although it is far from certain that this 
would constitute any significant lengthening.  

However,  the  assumption  used  in  this  report  is  that  the  Mandatory  Policy  would  include  some 
provisions  for  excluding  new  or  leading-edge  cloud  offerings  from  the  requirement  for  portability,  as 
long  they  saw  evidence  that  the  providers  and  its  associated  third-party  ecosystem  would  within  a 
reasonable  timeframe  create  tools  and  standards  for  end-user  organizations,  resulting  in  the  new 
offering with industry-standard levels of portability. Therefore, in the context of portability, provided that 
certain  requirements  are  met  and  assuming  the  "innovation-friendly"  approach  to  regulation,  the 
introduction of a Mandatory Policy would not discourage CSPs from launching new services that are 
not in their early iterations easy to migrate from.  

8 

 
 
 
Recommendations to the European Commission 

Introduce a Right to Data and Application Portability  

The European Commission is advised to take action by introducing a statutory right providing for the 
portability of cloud service customers' data and applications. The analysis and the evidence collected 
have shown in a convincing manner that the most effective way to lift the portability barriers identified 
would be by assigning cloud service providers with such an obligation by law. 

Continue Working with Cloud Stakeholders  

The European Commission is advised to continue and to strengthen the initiatives taken in relation to 
the creation of a discussion platform for all cloud stakeholders. 

Recommendations to EU Member States 

Encourage Awareness of the Need for ‘Exit Plans’ in cloud contracts 

National Governments are advised to encourage organizations’ awareness of the need for clear and 
well-defined  "exit  plans"  that  contain  appropriate  measures  to  will  guarantee  that  data  and/or 
applications  can  be  ported  between  cloud  services  with  minimal,  reasonable  and  pre-agreed  costs 
and delays. 

Encourage Dissemination of Best Practices of cloud migration and data porting 

National Governments are advised to encourage dissemination of best practices facilitating promotion 
of greater levels of portability in accordance to the building blocks and other components discussed in 
the report. 

Allocate Reasonable Levels of Resources to Monitor Compliance  

National Governments are advised to allocate reasonable resources to the competent authority to be 
assigned  with  the  supervisory  role  to  monitor  compliance.  For  instance,  auditing  of  cloud  service 
providers requires investment on appropriate organizational resources and expertise. 

Recommendations to Cloud Business Users 

Implement ‘Exit Plans’ from cloud contracts 

Organizations’ of all sizes, including both cloud service providers and their customers, should provide 
and implement concrete cloud-service “exit plans’’. 

Meaningful and effective redress 

Contractual  agreements  between  organizations  of  all  sizes  should  provide  for  “meaningful  and 
effective’' redress, in case the portability related requirements (e.g. service level objectives) set in the 
contract are not met. 

Treat Portability Strategically, and Plan for it. 

9 

 
 
Organizations of all sizes, including both cloud service providers and their customers, should consider 
portability  of  data  and  applications  in  a  strategic  manner  and  provide  for  it  within  their  business 
continuity plans. 

Obtain Data Subject’s Consent Before Porting Their Data 

Organizations  acting  in  their  capacity  as  cloud  service  customers  should  obtain  contractually 
appropriate  consent  in  order  to  request  their  cloud  service  provider  to  port  the  data  of  the  data 
subjects. 

Methodology approach 

The study team carried out extensive desk and field research.  The evidence base includes:  

  16 Case studies of cloud customers dealing with data or application portability;  
  9 Case studies of cloud service providers 
  10 online questionnaires on cloud portability issues 
 

the results of a Stakeholder workshop held in Brussels in May 2017, with 40 participants from 
industry, policy and research; 

  additional data collection on cloud migration costs in June/July 2017 
  additional email survey with cloud service providers in October 2017 

10 

 
 
 
European Commission 

SMART 20160032 Switching of Cloud Services Providers 

Luxembourg, Publications Office of the European Union 

2018 – 12 pages  

ISBN 978-92-79-77790-5 

doi: 10.2759/774982 

 
 
 
 
 
 
 
K
K
-
0
2
-
1
8
-
0
2
8
-
E
N
-
N

K

K

-

0

4

-

1

8

-

0

0

9

-

E

N

-

N

doi: 10.2759/457551 

ISBN 978-92-79-77685-4 

doi: 10.2759/774982 

ISBN 978-92-79-77790-5