iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device.

CloudKit is a similar technology that allows (from what I can tell) the partial synchronization of that data among devices.

Are these technologies suitable for a US or UK based citizen to store their PII data? I'm asking because I'm a software developer looking for a place to save this information. Since I don't have the ability to direct UK based users to a UK based server, as I can in Azure, I assume this might be done transparently on a per user basis.


If you are utilizing a cloud service where you cannot control where data is stored, there may be potential legal risks. For example, in some cases US data stored on EU servers may be deemed subject to EU data directive privacy controls and data stored in the US may not meet EU requirements or have sufficient safe harbor. Other odd cases come up in cross-border data storage.

Any specific legal requirements would have to be a factor of the actual data and the specific laws - e.g., healthcare data and HIPAA. For the specific legal issues, those are going to be off topic, and you will need to consult a Lawyer for an appropriate answer.

There are likely other legal or security risk to consider such as encryption, guarantees over deletion, etc - these are common concerns for any cloud service provider. You may want to check out some of the resources from Cloud Security Alliance to use in your assessment of a cloud provider.

Moreover, you may have issues with the specific classes of data in synchronizing or even the security and confidentiality of an iPhone in general (where is it being copied to, how do you secure those other devices/servers?).

In general, the less control you have over the service provider and the data,the greater the difficulty will be in meeting various overlapping and often conflicting legal laws. Where possible, leave data in it's country of origin. There may also be a difference between where the user chooses to store and move their data versus "you the company" moving it. Again, you will need to consult with a lawyer.

Some links to consider:

Your Answer

