The Upload Button Has a Paper Trail: Cloud Genomics Checks for UK Labs

Picture the scene. A PhD student has a folder of FASTQ files, a cloud account with a free trial, and a supervisor who wants the analysis running before Friday. The upload takes twelve minutes. The question that follows takes longer: who agreed to the data processing terms, and where is that agreement kept?

Cloud genomics is normal now. What is still patchy is the paperwork around it. Labs can explain variant calling, batch effects and reference genomes, but ask for the data-flow map and you may get a blank look. This is not about being frightened of the cloud. It is about being able to explain, in plain English, what happens to patient or participant data once it leaves the bench.

Start with the data, not the dashboard

Before anyone gets excited about a new platform, write down what is actually moving. Is it raw reads, aligned BAMs, variant call files, a summary report, or just sample metadata? Each has a different risk profile. A VCF with a handful of common variants is not the same as a whole-genome sequence linked to a named patient and a rare disease. The cloud provider does not need to know the biology, but your data processing agreement does need to match the data you are sending.

Also be honest about the surroundings. Genomics data rarely travels alone. There is often a sample sheet with NHS numbers, hospital IDs, dates of birth, consent flags, or a lookup table sitting in someone’s shared drive. If that metadata goes up with the sequence, the cloud job is processing personal data even if the FASTA looks innocuous.

The DPA is not a procurement souvenir

Under the UK GDPR, when a controller uses a processor, there needs to be a written contract. In cloud terms, that is usually the data processing agreement, or DPA. It should set out the subject matter, duration, nature and purpose of processing, the type of personal data, the controller’s instructions, and the processor’s obligations. It should also cover sub-processors, security, breach notification and what happens at the end of the contract.

For a UK lab, the practical question is simple: can you find the version that applies to your account, and does it match the service you are using? A free-tier account may have different terms from an enterprise tenancy. A platform bought through a university may sit under the university’s contract, not the lab’s. If the DPA is buried in a supplier portal, download it, date it, and keep it with the project record. Do not rely on a colleague’s memory of a procurement meeting in 2023.

Sub-processors matter too. Many cloud genomics platforms use third-party compute, storage, support or analytics providers. The DPA should give you a way to see who they are and how changes are notified. If your data are sensitive, an unexplained sub-processor list is a reason to pause.

Residency, sovereignty and the NHS bit

Data residency is where the data are stored. Data sovereignty is who has legal control over them. They are related but not the same. A UK region on a cloud platform is a good start, but it does not answer every question about access, support staff, backups or legal requests.

If you work with NHS-commissioned data, expect extra scrutiny. NHS bodies routinely ask about storage location, access controls, retention and the Data Security and Protection Toolkit. The exact expectations depend on the organisation and the data, but the direction of travel is clear: you should be able to say where the data sit, who can reach them, and how access is logged. “It’s in the cloud” is not an answer. “It is in a UK region, access is restricted to two named accounts with multi-factor authentication, and the audit log is retained for twelve months” is better.

International transfers need care. If any support, backup or analytics step touches a country outside the UK, you need the right transfer mechanism and a record of it. That might be an adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. This is where a quick chat with your information governance lead beats a heroic guess.

“It’s anonymised” is a sentence that needs evidence

Genomic data are awkward. They are rich, rare and often linkable. A rare variant plus a postcode plus a recruitment date can narrow a population quickly. Removing names is not the same as anonymisation. Pseudonymised data are still personal data under the UK GDPR, because someone holds the key that can re-identify them.

If someone says the dataset is anonymous, ask for the reasoning. Was a motivated intruder test done? Was linkage risk assessed? Are rare variants, dates and geography still present? Is there a separate metadata file that gives the game away? For small cohorts, the honest answer may be that the data are pseudonymised, not anonymous, and should be treated accordingly.

This is not a reason to avoid cloud analysis. It is a reason to avoid magical thinking. The safest habit is to assume genomic data can identify someone unless you have documented why they cannot in this specific dataset.

Questions to ask before you click upload

• Who is the controller for this dataset, and who is the processor?
• Which DPA applies, and where is the signed or accepted version stored?
• Which cloud region holds the data, and where are backups and support access?
• Are there sub-processors, and how will we be told about changes?
• Is the data personal, pseudonymised or anonymous, and what is the evidence?
• Who can access the data, and is multi-factor authentication enforced?
• What are the retention and deletion rules, and what evidence will we get at the end?
• If data leave the UK, what transfer mechanism is in place?

Make the audit trail boring

A good cloud genomics audit trail is dull in the best way. It is a one-page data-flow map, a copy of the DPA, a note of the cloud region, a sub-processor check, an access list, a retention decision and a deletion receipt. It should take half an hour to assemble, not a weekend.

Early-career scientists are often the first to touch the upload button, but they are rarely the ones who own the contract. That is exactly why they should ask. A quick question before upload is cheaper than a painful reconstruction six months later. The sequence may be in the cloud, but the paper trail should be somewhere you can actually find it.

This is practical guidance, not legal advice. For live NHS or patient data, check with your organisation’s information governance team before you move anything.