Can I store official records in the cloud?

Yes. In nearly every context, official records may be stored in the cloud — but only if the controls that make information trustworthy travel with it. The cloud is a storage and computing location, not a different category of record. A record’s legal status, retention obligations, and accountability requirements do not change simply because the data lives on infrastructure operated by a third party.

What stays the same

A record is a record regardless of where it is stored. Whatever rules already apply to your records on local servers or paper still apply in the cloud:

• Retention and disposition under an approved schedule.
• Authenticity and integrity — the record must remain complete, unaltered, and reliably attributable to its source.
• Accessibility for the full retention period, including readable formats and usable metadata.
• Legal holds, discovery, and (for public bodies) public-records and privacy obligations.

What you must add for the cloud

Because a vendor now holds your data, a few concerns become sharper:

• Custody and control. Your organization remains accountable for the record even though it does not run the hardware. Contracts should make this explicit.
• Security and location. Confirm encryption, access controls, and — where it matters — where data physically resides. Records with personal, confidential, or regulated content may carry residency or handling restrictions.
• Retention enforcement. Confirm the service can apply your retention rules and execute defensible disposition, rather than silently keeping or deleting data on its own schedule.
• Exit and portability. Plan from day one for how you will export records, with metadata intact, if you change providers or the service ends. Avoid being locked into a format only one vendor can read.

Practical guidance

Treat cloud adoption as a records decision, not just an IT decision. Update your policies and schedules to cover cloud-held records, document the vendor relationship, and verify the service supports trustworthy capture, retention, and disposition. International standards for records in digital environments offer a useful framework for these requirements.

For more on managing born-digital and stored-digital records, see the electronic records hub.

The bottom line: cloud storage is permissible and common, but it shifts where records live without shifting who is responsible for keeping them trustworthy.