Your Files in the Cloud: What Are You Actually Agreeing To?
Cloud storage has become a default part of modern digital life in the UK. Whether you're using Google Drive on an Android phone, OneDrive on a Windows 11 laptop, or iCloud on an iPhone, your documents, photos, and personal files are almost certainly being stored on servers owned by large American technology companies. Most people accept the terms of service without reading them — and those terms contain some important details about how your data is handled, who can access it, and what rights you retain over your own files.
This guide, compiled from the published privacy policies, terms of service, and UK regulatory guidance available as of September 2026, explains what the three dominant cloud storage services — Google Drive, Microsoft OneDrive, and Apple iCloud — actually do with your data, how UK law applies, and what practical steps you can take to protect your privacy. It also covers encrypted alternatives for users who want stronger guarantees.
The Legal Framework: UK GDPR and Cloud Storage
Since the UK's departure from the European Union, data protection in the UK is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO). Under UK GDPR, any organisation processing the personal data of UK residents must have a lawful basis for doing so, must be transparent about how data is used, and must implement appropriate technical and organisational security measures.
All three major cloud storage providers — Google, Microsoft, and Apple — operate under data processing agreements that acknowledge UK GDPR obligations. However, because these companies are headquartered in the United States, your data may be transferred to and processed in the US or other countries. Under UK GDPR, international data transfers require appropriate safeguards, such as Standard Contractual Clauses (SCCs) or an adequacy decision. The UK has its own adequacy framework, and as of September 2026, the UK has granted adequacy decisions for a limited number of countries. For transfers to the US, providers rely on SCCs or the UK-US Data Bridge (the UK's equivalent of the EU-US Data Privacy Framework, which came into force in October 2023).
The ICO's guidance on cloud storage is clear: using a cloud service does not transfer your data protection responsibilities to the provider. If you store personal data about others (clients, employees, customers) in the cloud, you remain the data controller and are responsible for ensuring the provider processes that data lawfully.
Google Drive: What Google Knows About Your Files
Google Drive is included with every Google account and offers 15GB of free storage shared across Drive, Gmail, and Google Photos. Paid plans are available through Google One, starting at £1.59 per month for 100GB as of September 2026 (prices subject to change).
What Google's Terms Say
Google's Terms of Service grant Google a worldwide licence to use, host, store, reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly display, and distribute content you upload to its services. Google states this licence is for the limited purpose of operating and improving its services. Crucially, Google's privacy policy states that it does not sell your personal information to third parties.
However, Google does scan the content of files stored in Google Drive for several purposes: to detect malware and spam, to enforce its terms of service (for example, to detect child sexual abuse material, which is a legal obligation), and — if you use Google Workspace's free tier — potentially to serve personalised advertising. Paid Google Workspace subscribers and Google One subscribers are not subject to ad personalisation based on Drive content.
Encryption
Google encrypts data in transit using TLS and at rest using AES-256 encryption. However, Google holds the encryption keys — meaning Google (and, in response to a valid legal order, law enforcement) can decrypt and read your files. Google does not offer end-to-end encryption for Drive files, meaning there is no option to store files that even Google cannot read.
Government Access
Google publishes a Transparency Report that details government requests for user data. In the first half of 2025, Google received approximately 60,000 government requests globally, disclosing data in approximately 72% of cases. UK government requests are included in these figures. Google states it reviews each request carefully and notifies users where legally permitted.
Microsoft OneDrive: What Microsoft Knows About Your Files
OneDrive is integrated into Windows 11 and included with Microsoft 365 subscriptions. Standalone plans start at £1.99 per month for 100GB as of September 2026 (prices subject to change). Microsoft 365 Personal (£59.99 per year as of September 2026, prices subject to change) includes 1TB of OneDrive storage.
What Microsoft's Terms Say
Microsoft's Services Agreement grants Microsoft a worldwide, royalty-free licence to use, reproduce, distribute, and display content you store in OneDrive, for the purpose of providing and improving its services. Microsoft's privacy statement states it does not use the content of your files to target advertising.
Microsoft scans OneDrive content for illegal content (including CSAM) and to enforce its terms of service. Microsoft also uses automated scanning to detect malware. For Microsoft 365 business subscribers, Microsoft's data processing agreement provides additional contractual protections under UK GDPR.
Encryption
Microsoft encrypts OneDrive data in transit using TLS and at rest using BitLocker (AES-256) at the disk level, with per-file encryption keys managed by Microsoft. Like Google, Microsoft holds the encryption keys. Microsoft does not offer end-to-end encryption for standard OneDrive storage. However, Microsoft 365 Personal and Family subscribers have access to the Personal Vault feature, which adds an additional layer of identity verification (PIN, fingerprint, or two-factor authentication) before accessing a protected folder — but this is an access control measure, not end-to-end encryption.
Government Access
Microsoft publishes a Law Enforcement Requests Report. Microsoft states it challenges overly broad or legally deficient requests and notifies users where legally permitted. Microsoft has also committed to storing EU and UK customer data within the EU and UK under its EU Data Boundary initiative, which applies to Microsoft 365 commercial customers.
Apple iCloud: What Apple Knows About Your Files
iCloud is Apple's cloud storage service, tightly integrated with iOS, iPadOS, and macOS. Free storage is 5GB, with paid plans starting at £0.99 per month for 50GB as of September 2026 (prices subject to change). iCloud+ plans (from £0.99/month) include additional privacy features such as iCloud Private Relay and Hide My Email.
What Apple's Terms Say
Apple's iCloud Terms and Conditions grant Apple a licence to use, reproduce, and display content you store in iCloud for the purpose of providing the service. Apple's privacy policy states it does not sell personal data and does not use iCloud content to build advertising profiles.
Encryption: Apple's Advanced Data Protection
Apple offers two levels of iCloud encryption:
- Standard Data Protection (default): Most iCloud data is encrypted in transit and at rest, but Apple holds the encryption keys. This means Apple can access your data and can respond to law enforcement requests.
- Advanced Data Protection (opt-in): Introduced in December 2022 and available to UK users, Advanced Data Protection extends end-to-end encryption to the majority of iCloud data categories, including iCloud Drive, Photos, Notes, Reminders, Safari bookmarks, Siri Shortcuts, Voice Memos, Wallet passes, and iCloud Backup. With Advanced Data Protection enabled, Apple does not hold the encryption keys — only your trusted devices can decrypt your data. This means Apple cannot respond to law enforcement requests for the content of these categories.
To enable Advanced Data Protection on an iPhone or iPad, go to Settings → [Your Name] → iCloud → Advanced Data Protection. Note that enabling this feature requires setting up account recovery contacts or a recovery key, as Apple cannot help you recover your data if you lose access to your account.
Government Access
Apple publishes a Transparency Report. Apple states it challenges requests it considers legally deficient. With Advanced Data Protection enabled, Apple cannot provide the content of end-to-end encrypted data even if legally compelled to do so.
Encrypted Alternatives: Proton Drive and Tresorit
For users who require stronger privacy guarantees than the major platforms offer, two end-to-end encrypted cloud storage services are available to UK users:
Proton Drive
Proton Drive is developed by Proton AG, a Swiss company headquartered in Geneva. It offers end-to-end encryption for all stored files, meaning Proton cannot read your data. Free storage is 1GB (shared with Proton Mail), with paid plans starting at £3.99 per month for 200GB as of September 2026 (prices subject to change). Proton Drive is available on Windows, macOS, iOS, and Android, and includes a web interface. Proton is subject to Swiss data protection law (the revised Federal Act on Data Protection, revFADP) and has a strong track record of resisting government requests for user data.
Tresorit
Tresorit is a Swiss-Hungarian end-to-end encrypted cloud storage service aimed at business users and privacy-conscious individuals. It is available to UK users, with plans starting at approximately £8.33 per month (billed annually) for 500GB as of September 2026 (prices subject to change). Tresorit is certified under ISO 27001 and is compliant with UK GDPR. It offers end-to-end encryption with zero-knowledge architecture — Tresorit cannot access your files.
Practical Privacy Steps for UK Cloud Storage Users
- Enable Apple Advanced Data Protection if you use iCloud — it is the most significant privacy upgrade available to iPhone and Mac users at no extra cost.
- Use strong, unique passwords and enable two-factor authentication on all cloud storage accounts. The ICO recommends two-factor authentication as a baseline security measure.
- Review what you store. Avoid storing highly sensitive documents (passports, financial records, medical information) in standard cloud storage without additional encryption.
- Encrypt before uploading. Tools such as Cryptomator (free, open-source, available on Windows, macOS, iOS, and Android) allow you to encrypt files locally before uploading them to any cloud service, including Google Drive and OneDrive. This gives you end-to-end encryption regardless of the provider's own encryption model.
- Check your sharing settings. Files shared via a link in Google Drive or OneDrive may be accessible to anyone with that link. Review sharing permissions regularly.
- Read the transparency reports. Google, Microsoft, and Apple all publish annual transparency reports detailing government data requests. These are publicly available on each company's website.
Comparison Table: Cloud Storage Privacy UK 2026
| Service | Free Storage | Paid Plans (from, Sept 2026) | Encryption at Rest | End-to-End Encryption | Ad Targeting from Files | UK GDPR Compliant |
|---|---|---|---|---|---|---|
| Google Drive | 15GB | £1.59/month (100GB) | AES-256 (Google holds keys) | No | No (paid plans) | Yes |
| Microsoft OneDrive | 5GB | £1.99/month (100GB) | BitLocker AES-256 (Microsoft holds keys) | No | No | Yes |
| Apple iCloud | 5GB | £0.99/month (50GB) | AES-128/256 (Apple holds keys by default) | Yes (Advanced Data Protection, opt-in) | No | Yes |
| Proton Drive | 1GB | £3.99/month (200GB) | End-to-end (Proton holds no keys) | Yes (always) | No | Yes (Swiss law + UK GDPR) |
| Tresorit | 5GB (trial) | ~£8.33/month (500GB) | End-to-end (zero-knowledge) | Yes (always) | No | Yes (ISO 27001 + UK GDPR) |
All prices are approximate as of September 2026 and are subject to change. Check current pricing at each provider's UK website before subscribing.
The Bottom Line: How Private Is Your Cloud Storage?
For most UK users, Google Drive, OneDrive, and iCloud offer adequate security against external threats — your files are encrypted and protected from casual interception. However, none of these services (in their default configuration) offer true end-to-end encryption: the provider holds the keys and can, in principle, read your files or hand them over to law enforcement in response to a valid legal order.
If you want stronger privacy guarantees, Apple's Advanced Data Protection is the easiest upgrade for iPhone and Mac users. For cross-platform end-to-end encryption, Proton Drive is the most accessible option. For the highest level of privacy with business-grade compliance, Tresorit is worth the premium.
Whatever service you use, enabling two-factor authentication, using strong passwords, and being thoughtful about what you store in the cloud are the most impactful steps you can take to protect your data. The ICO's website (ico.org.uk) provides further guidance on your rights under UK GDPR, including your right to access, correct, and delete personal data held by cloud providers.
Tom Barrows
Editor, HomeTechLAB
Researched and drafted with AI, reviewed and edited by Tom Barrows. How we produce our guides
Last updated: 1 Oct 2026
Please note: Everything on HomeTechLAB is our subjective opinion, offered to help with your research — not a statement of fact. Always do your own research and check current details with the retailer or manufacturer before you buy.
