Overview
ISO/IEC 19944-1:2020 - "Cloud computing and distributed platforms ─ Data flow, data categories and data use - Part 1: Fundamentals" defines foundational concepts for data flow and data categories across ecosystems that combine devices and cloud services. Building on the Cloud Computing Reference Architecture (CCRA) in ISO/IEC 17788 and 17789, this standard describes the types of data that travel between devices, cloud services, customers and users, and explains how connected devices impact those flows. It is primarily intended for cloud service providers, cloud service customers, cloud service users and stakeholders involved in legal, policy or technical decisions.
Key topics
- Data taxonomy and categories: Defines customer content data, derived data, cloud service provider data and account data to standardize how data types are classified.
- Data identification qualifiers: Explains identified, pseudonymized, unlinked pseudonymized, anonymized and aggregated data.
- Orthogonal data facets: Introduces attributes (facets) used to describe data from multiple perspectives (privacy, IP, sensitivity).
- Data processing and use categories: Covers common operations such as partitioning, integration, fusion, encryption, replication, deletion and re-identification, and use cases like provide, improve, personalize, market, share, collect and train (AI systems).
- Ecosystem and device impact: Extends the CCRA to include devices, BYOD scenarios, multi-user sub-roles and functional components influencing data flows.
- Scopes and data use statements: Defines scope boundaries for collection and use, and a structured data use statement format to declare how data are handled.
- Data lineage and provenance: Provides guidance on tracing data origins and transformations across distributed systems.
Applications
- Create clear, machine- and human-readable data use statements for services and apps.
- Design privacy-by-design cloud architectures that align data handling with legal and policy requirements.
- Standardize data classification for interoperability between cloud service providers and customers.
- Support risk assessments, audits and contractual clauses about data processing, sharing and AI model training.
- Help product managers and architects define how device-generated data flow into cloud services and downstream uses.
Who should use it
- Cloud service providers and platform architects
- Cloud service customers and enterprise IT teams
- Privacy, legal and compliance officers
- Product managers of connected device ecosystems
- Architects of AI/ML systems needing clear provenance and training-data policies
Related standards
Keywords: ISO/IEC 19944-1:2020, cloud computing, data flow, data taxonomy, data use statement, data categories, devices, cloud service provider, data lineage, privacy.