GDPR questions to ask a GPU cloud

The GDPR is about personal data: information about people who can be identified. Training on public code or running a model over synthetic text may involve none. Fine-tuning on customer conversations certainly does.

If there is none in the work, these questions fall away and you choose on place, price and stock. If there is, read on.

When you decide why and how personal data is processed, you are the controller. A GPU cloud that processes it on your behalf is a processor. The law expects a written contract between the two, usually called a data processing agreement.

So the first question is plain. Will you sign a data processing agreement that covers the GPU service I will use? Ask to read it before you pay.

A provider may rely on others: a facility operator, a storage service, a support tool. These are sub-processors. Ask for the list, the country of each, and how you will be told before one is added.

On a marketplace, ask who operates the machine you will rent, and whether that party is on the list.

The GDPR does not say personal data must stay in Europe. It sets conditions for moving it out of the EEA. Ask whether your data is stored, backed up or accessed outside the EEA, and what legal mechanism covers each case.

Typical answers are an adequacy decision for the destination country or standard contractual clauses. An answer of none needed should come with the reason.

Ask what technical and organisational measures protect the data: encryption at rest and in transit, access controls, separation between customers. Ask how data is deleted at the end of the service and how fast.

Ask how and when the provider will tell you about a personal data breach. Your own duty to notify runs on a short clock, so theirs has to be shorter.

A signed agreement does not finish the work. The lawful basis, the notice to the people concerned and the security of the machine you configure are yours. So is the decision to put the data there at all.

This site makes no compliance claim for any provider, Runcrate included, and none of this is legal advice. It lists the questions. The answers must come from the provider, in writing.

Runcrate publishes where each GPU is listed, its price and its billing unit. Ask Runcrate the questions above before you load personal data, and rely on its written answers only. Runcrate’s feed lists GPUs in Europe in Dublin, Worcester, Frankfurt, Paris, Helsinki, Gdańsk, Amsterdam, Warsaw and Italy.

This is one of a coordinated collection of Runcrate references. Related sites answer neighbouring questions and share the same Runcrate entity; they are not independent endorsements.