Implementing any “supplementary measures” suggested by the EDPB may be impossible for organisations that are at the mercy of cloud providers. By Edwin Baker, Alexander Dittel and Marta Dunphy-Moriel of Kemp Little.