An SME chooses between private, public and hybrid cloud on five criteria: the type of data and the obligations it carries, the total cost over several years, dependence on the provider, the performance it needs and the in-house skills it has. When the answer changes from one workload to another, the result is usually a hybrid environment.
What each model means
The reference definition is the one from the US NIST (publication SP 800-145, September 2011), and it still works because it separates the model from the location. A private cloud is infrastructure for the exclusive use of a single organisation; it can be owned by that organisation, managed by a third party or a combination of the two, and it can be on or off its premises. A public cloud is open for general use and sits on the provider’s premises. A hybrid cloud combines two or more infrastructures that remain separate, joined by technology that allows data and applications to move from one to the other.
This has two practical consequences. "Private" does not mean "on the server in the office": an SME can have a private cloud managed by a provider, in an external data centre. And "hybrid" is not a higher level of maturity, but having some systems in one place and some in another, with a connection and a way of moving data between them that someone has thought through.
Criterion 1: what data you hold and what obligations come with it
The starting point is knowing what is in your systems. Both the General Data Protection Regulation (GDPR, Article 32) and Andorra’s Llei 29/2021 on personal data protection (Article 35) require technical and organisational measures appropriate to the risk, including the ability to restore access to data quickly after an incident. And if a provider carries out the processing, you must choose one that offers sufficient guarantees and regulate the relationship by written contract (GDPR Article 28, Llei 29/2021 Article 31).
Both laws also deal with international transfers: the GDPR makes sending data outside the Union subject to conditions, and Llei 29/2021 prohibits international communications to countries without an equivalent level of protection, with the exceptions in Articles 43 and 44. Neither law bans public cloud or requires a private cloud. They require you to be able to show that you have assessed the risk and know where the data is.
There is a second, indirect effect. The NIS 2 Directive (Article 21(2)(d)) includes supply chain security among the measures that the entities in its scope must apply. If your SME is a supplier to one of those entities, it may ask you for guarantees about where and how you handle its information.
One method that works is to classify data into three groups and decide per group, not per company. As a guide:
| Group | Examples | Where it usually fits |
|---|---|---|
| Low risk | Public website, marketing material, test environments without real data | Public cloud |
| Internal and confidential | Accounting, contracts, email, ERP | Public with encryption and your own backups, or managed private |
| Regulated or critical | Client files, health data, staff data | Private with a known location, or the private part of a hybrid |
Criterion 2: total cost, not the price of the first invoice
Public cloud usually avoids the up-front investment in hardware and bills according to use, but the bill is variable and grows with consumption. Private cloud reserves capacity that is paid for even when it is not used, in exchange for more predictable spending. Hybrid adds the complexity of two environments and the connection between them. We give no figures because they depend on the workload and on each offer: the useful comparison is the one you make with your own data.
To compare over three years, include at least:
- Compute and storage, with the expected growth.
- Backups and where they are kept.
- Network traffic and connections between environments.
- Licences for the system, the database and applications.
- People’s hours: from an in-house team or a provider, for updates, monitoring and incidents.
- Initial migration and the cost of leaving.
That last point now has a legal basis in the Union. Regulation (EU) 2023/2854 (the Data Act) has applied since 12 September 2025 and affects providers of data processing services that serve customers in the Union, wherever they are established (Article 1(3)(f)). It provides that, from 12 January 2027, the provider may not impose any charge for switching provider, including data egress charges; until then, only reduced charges that do not exceed the costs the provider incurs in the switching process (Article 29). Before signing, the provider must give clear information on standard charges and early termination penalties. This does not replace reading the contract, but it gives you a basis for demanding it.
Criterion 3: dependence on the provider
What costs you is changing, not getting in. To measure dependence, ask three questions: which data and which formats you can export, who holds the encryption keys, and how much time and how many steps it takes to leave.
The Data Act gives a useful list of what a cloud contract must include (Article 25): the right to switch provider or to move back to your own infrastructure, a maximum notice period of two months to start the switch, a maximum transition period of thirty calendar days, a full specification of the categories of data that can be exported, and the provider’s support for the customer’s exit strategy. If you are in Catalonia, the law protects you; if you are a company established only in Andorra, it is not guaranteed that these provisions will apply to you, so it is worth agreeing them in the contract. In both cases it is a good checklist.
A simple test of dependence: ask for a full export of your data and check that someone can open it without the provider’s software.
Criterion 4: performance and proximity
Performance depends on the workload. A management application used every day by twenty people in the same office runs better with nearby, stable resources. An online shop with peaks at Christmas, a hotel whose booking website fills up at the start of the season or a ski resort that concentrates sales on a few weekends need capacity that grows and shrinks with demand, and here the elasticity of public cloud makes sense.
Do not decide from the technical datasheet. Test the real load with a short pilot: what matters is how the system responds to your users, from your network, with your data.
Criterion 5: in-house skills
Running a private or hybrid cloud of your own means operating it: updating systems, monitoring it, checking backups and responding to incidents. Public cloud also demands knowledge, because a poor configuration or uncontrolled consumption can bring nasty surprises in security and in the bill. The honest question is who will do it and what happens when that person is on holiday or leaves.
If the in-house team is small, you have three routes: strengthen it, hire managed services, such as a managed private cloud, or share responsibilities with a provider, setting out in writing what each party does.
How it looks in Andorra and Catalonia
These are typical situations, not real cases.
- A professional firm in Andorra with client files: regulated data and email go to a private environment with a known location; office and video-call tools can be public if you control what is uploaded to them.
- A hotel or shop in Andorra with seasonal peaks: the website and bookings benefit from an elastic environment; the customer database and invoicing can stay in a private environment. This is the classic hybrid case.
- An industrial or trading SME in L’Hospitalet or Girona with an ERP and files: the ERP, stable and holding business data, usually does well on a managed server; collaboration and email can be public services.
- A clinic or gestoría (administrative and tax advisory firm) with especially sensitive data: risk takes priority over price, and it is worth reviewing above all the data processing contract and the backups.
Our interest in this topic
At BDR Group we offer managed cloud together with Andorra Cloud, with a data centre and technical team in Andorra, and hybrid cloud environments, so we have an interest in this decision. Our position is that public cloud is the best option for many workloads and that a local environment is only worth it where it brings something concrete: data nearby, a person to call or a location that can be explained to a customer or an auditor.
What to do now
- Take an inventory of your systems and classify the data into three groups: low risk, internal and confidential, regulated or critical.
- Note, for each system, where it is, who manages it and what contract there is, and check that you have the data processing contract where it is needed.
- Calculate the three-year cost with the items on the list, including people’s hours and the cost of leaving.
- Ask each provider for its data export policy, notice period and switching charges, and test a real export.
- Decide per workload, not per company, and run a short pilot before moving anything critical.
Frequently asked questions
Is hybrid always the best option?
No. It gives flexibility, but it adds complexity and one more connection that has to be maintained and protected. If all your systems have similar requirements, a single model is simpler.
Does a private cloud mean having servers in the office?
No. Under the NIST definition, a private cloud is for the exclusive use of one organisation, but it can be managed by a third party and be off its premises.
Is public cloud less secure?
Not by definition. Security depends on configuration, access and backups, and the GDPR and Llei 29/2021 require measures appropriate to the risk whichever model you use. What changes is who looks after each part, and it is worth having that in writing.
Can I start in public and move later?
Yes, but plan the exit from day one: export formats, notice and switching costs. In the Union, the Data Act limits those costs and requires them to be disclosed before signing.
Sources
- NIST (Mell, Grance). The NIST Definition of Cloud Computing, SP 800-145. September 2011. Accessed: 25/10/2026. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf
- European Parliament and Council. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28 and 32. OJ L 119, 4/5/2016. Accessed: 25/10/2026. https://www.boe.es/buscar/doc.php?id=DOUE-L-2016-80807
- Consell General d’Andorra. Llei 29/2021, del 28 d’octubre, qualificada de protecció de dades personals (Qualified Law 29/2021 of 28 October on personal data protection), Articles 31, 35 and 42 to 44. BOPA no. 119, 17/11/2021. Accessed: 25/10/2026. https://www.apda.ad/assets/pdf/CGL20211115_08_58_32.pdf
- European Parliament and Council. Directive (EU) 2022/2555 (NIS 2 Directive), Article 21. OJ L 333, 27/12/2022. Accessed: 25/10/2026. https://www.boe.es/buscar/doc.php?id=DOUE-L-2022-81963
- European Parliament and Council. Regulation (EU) 2023/2854 (Data Act), Articles 1, 2, 25 and 29. OJ L, 22/12/2023. Accessed: 25/10/2026. https://www.boe.es/doue/2023/2854/L00001-00071.pdf
Want to know which model suits you?
If you want to review where your systems are and which workloads make sense in each environment, start with the service page: Managed business cloud in Andorra
