Cloud Computing

Private cloud is dedicated infrastructure for a single organisation, hosted on-premise or by a provider.

Cloud Computing is the on-demand delivery of IT resources, servers, storage, databases, software, over the internet with pay-as-you-go pricing, with three NIST-defined service models (IaaS, PaaS, SaaS) and four deployment models (public, private, hybrid, community). Also called: the cloud, on-demand computing, utility computing.

The three service models: iaas, paas, saas

NIST and industry practice define three primary cloud service models, differing in what the customer manages vs what the cloud provider manages.

Additional models that have emerged: DaaS (Desktop as a Service), FaaS / Serverless (Function as a Service), BaaS (Backend as a Service), DBaaS (Database as a Service). The ‘X-as-a-Service’ suffix has proliferated.

Deployment models: public, private, hybrid, multi-cloud

Beyond service model, cloud deployments are classified by who has access and where the infrastructure runs:

• Public cloud. Shared infrastructure operated by a third-party provider (AWS, Azure, GCP); resources allocated dynamically to many customers. Maximum elasticity and lowest cost; less control over specific infrastructure.
• Private cloud. Cloud infrastructure dedicated to a single organisation; either hosted on-premise or by a provider. More control; more cost. Common in financial services, government, highly-regulated industries.
• Hybrid cloud. Combination of public and private cloud, with data and applications moving between them. Sensitive workloads in private cloud, scalable workloads in public cloud. Common enterprise model.
• Multi-cloud. Using multiple public cloud providers (often AWS + Azure or AWS + GCP) to avoid vendor lock-in, optimise costs, or leverage specific provider strengths. Most large enterprises operate multi-cloud whether deliberately or by accident.
• Community cloud. Infrastructure shared between organisations with common concerns (e.g., regulatory, security). Less common; mostly used in government and healthcare contexts.

The big three hyperscale providers: aws, azure, gcp

Other significant providers: IBM Cloud (strong in regulated industries), Oracle Cloud Infrastructure (OCI), Alibaba Cloud (dominant in China). Most large enterprises run multi-cloud across at least AWS + Azure.

Why cloud computing matters for HR

HR practitioners interact with cloud computing primarily through SaaS HR applications, but understanding the foundation matters for several reasons:

• HRIS / HCM platforms are SaaS. Workday, SAP SuccessFactors, Rippling, BambooHR, all SaaS applications running on cloud infrastructure. Cloud architecture explains why deployment is faster, updates are continuous, and integration is API-first compared to on-premise legacy systems.
• Global workforce enablement. Cloud computing enables global employee access without geographic infrastructure investment; remote work and distributed teams depend on cloud-native HR tools.
• Data analytics and AI. People analytics, workforce planning, and Artificial Intelligence (AI) in HR applications require scalable compute and data infrastructure. The Chief Information Officer (CIO) typically owns cloud strategy and AI governance at the enterprise level.
• Big Data in HR and analytics. Cloud data warehouses (Snowflake, BigQuery, Databricks) are now standard for HR analytics at scale.
• Integration ecosystem. API-first cloud architecture enables HRIS to integrate with ATS, learning platforms, communication tools, and ERP.
• Cost model implications. HR tech cost shifted from capital expenditure (CapEx) to operating expenditure (OpEx). Changes how HR tech investment is justified and budgeted.
• BYOD enablement. Cloud-native apps are accessible from employee-owned devices, making BYOD policies feasible at scale.
• Chatbots and AI agents. Cloud LLM infrastructure (AWS Bedrock, Azure OpenAI, GCP Vertex AI) underpins the HR chatbot and agentic AI ecosystem in 2026.

Cloud security and compliance for HR data

HR data, names, addresses, dates of birth, national insurance / social security numbers, banking details, salary, medical information, performance records, is among the most-sensitive data categories. Cloud HR introduces specific security and compliance considerations:

• Data residency. GDPR requires EU personal data to remain in the EU or be transferred only under specific safeguards (Standard Contractual Clauses, EU-US Data Privacy Framework). Many cloud HR vendors offer EU-hosted instances.
• Cross-border data transfer. EU GDPR, India DPDP Act 2023, China PIPL, Brazil LGPD: multiple regimes restrict cross-border transfer of personal data. Multi-country employers need careful vendor selection.
• Encryption. Data encrypted at rest and in transit; key management options (vendor-managed vs customer-managed keys).
• Access controls. Single sign-on (SSO), multi-factor authentication (MFA), role-based access control (RBAC), least-privilege principles.
• Audit and compliance certifications. SOC 2, ISO 27001, HIPAA (where applicable), FedRAMP (US government), Cyber Essentials Plus (UK).
• Data deletion and portability. GDPR right to erasure and right to data portability require vendor capability.
• Vendor breach exposure. Cloud HR vendors hold employee data for many customers; breach exposure is concentrated. Notable historical breaches (UKG/Kronos ransomware 2021) caused significant downstream impact.

Common cloud computing misconceptions

• ‘The cloud is just someone else’s computer.’ Reductive. Hyperscale providers operate at scale and reliability no individual organisation can match.
• ‘Cloud is always cheaper.’ Not always. Steady-state predictable workloads can be cheaper on-premise. FinOps (cloud cost optimisation) has emerged as a discipline because cloud bills surprise CFOs without active management.
• ‘Cloud is always less secure.’ Most cloud security incidents trace to customer misconfiguration (open S3 buckets, weak access controls) rather than provider failures.
• ‘SaaS means no IT involvement.’ SaaS still requires identity integration, data integration, security review, vendor management, and ongoing optimisation.
• ‘Cloud means no data residency control.’ Modern cloud providers offer region-specific hosting, sovereign cloud options (UK, EU), and customer-managed encryption keys.

Frequently asked questions