† Cloud computing service providers, even those based outside Europe, may become subject to the EU Data Protection Directive's extensive and complex regime purely through their customers' choices, of which they may have no knowledge or control. Definitions Cloud computing definitions vary, but our definition is as follows: 8 † Cloud computing provides flexible, location-independent access to computing resources that are quickly and seamlessly allocated or released in response to demand. † Services (especially infrastructure) are abstracted and typically virtualized, generally being allocated from a pool shared as a fungible resource with other customers. † Charging, where present, is commonly on an access basis, often in proportion to the resources used. Cloud computing activities are often classified under three main service models: † Infrastructure as a Service (IaaS)-computing resources such as processing power and/or storage; 9 † Platform as a Service (PaaS)-tools for constructing (and usually deploying) custom applications; 10 † Software as a Service (SaaS)-end-user application functionality. 11 These services form a spectrum, from low-level (IaaS) to high-level (SaaS) functionality, with PaaS in between. One cloud service may involve layers of providers, not always to the customer's knowledge, and perspective affects classification. For example, customers of storage provider Dropbox may consider it a SaaS; while for Dropbox, which uses Amazon's IaaS infrastructure to provide its service, Amazon provides IaaS. 12 Furthermore, PaaS may be layered on IaaS, and SaaS may be layered on PaaS or IaaS. So, for example, PaaS service Heroku is based on Amazon's EC2 IaaS. 13 Cloud customers also increasingly combine different providers' services. Ancillary support for primary cloud services includes analytics, monitoring, 14 and cloudbased billing systems. 15 SaaS across different providers is increasingly integrated; for example, Google Apps MarketPlace enables customers of Google Apps SaaS office suite to use third party SaaS integrating with, and managed and accessed through, Google Apps. 16 These show increasing sophistication of cloud use and layering of providers. With traditional IT, organizations may install and operate different applications, while with cloud, customers increasingly integrate different cloud applications and support services, with each other and with legacy internal systems. The DPD's broad 'processing' definition includes any operation on data, including collection or considered 'personal data' in the hands of those without access to the decryption key, such as many cloud computing providers. 7 European Commission, 'A comprehensive approach on personal data protection in the European Union' (Communication) COM (2010) 609 final (November 2010); Neelie Kroes, 'Cloud computing and data protection' (Les Assises du Numérique conference,