Data Privacy in the Cloud: Trends, Risks, and Organizational Practices

Abstract

Cloud computing is increasingly leveraged by Bangladeshi organizations, including utilities, financial institutions, and technology firms, for scalable data storage and analytic capabilities. However, migrating sensitive operational and personal data to cloud environments introduces serious privacy challenges. This study investigates the evolving trends, risks, and organizational practices related to data privacy in the cloud within the Bangladeshi context. We conducted a cross-sectional survey of 132 IT and security decision-makers such as CISOs, cloud architects, and compliance officers to assess perceived risks, governance maturity, and technical control adoption. Key findings reveal that misconfiguration, insider threat, and weak key management are viewed as the most significant risks, while regulatory compliance (e.g., under Bangladesh’s new Personal Data Protection Ordinance) is also a major concern. On the governance front, 70% of organizations report having a formal data-governance framework, with over half using shared-responsibility matrices and including audit and breach-notification clauses in contracts. Technically, encryption (at-rest and in-transit) is widely used, but only a small fraction of firms has adopted advanced privacy-preserving technologies, such as homomorphic encryption or TEEs. Trust in cloud service providers is moderate (mean score ~3.6/5) and correlates strongly with governance maturity and external audits. Based on these insights and the regulatory landscape in Bangladesh, we organize organizational cloud privacy practices into a five-phase risk-management framework (Assessment, Design, Implementation, Monitoring, Review) to help organizations enhance their cloud privacy posture which is grounded theory in institutional and IT governance logic.