EMEA | Healthcare and life sciences
HDS v2.0
The French Public Health Code (Article L.1111-8) requires that service providers which host certain types of personal health information (PHI) receive HDS (Hébergeur de Données de Santé) certification. Introduced by the French governmental agency for health, ASIP Santé (Agence Française de la Santé Numérique), HDS provides a framework to strengthen the security and protection of PHI.
Building on this framework, HDS v2.0 brought several enhancements and reinforced focus on data sovereignty. Google has successfully transitioned from HDS to HDS v2.0. This makes us one of the first hyperscale cloud providers to be HDS v2.0 certified.
To achieve HDS v2.0 certification, providers must satisfy a detailed list of requirements regarding security measures to secure PHI and protect its confidentiality, mandatory contract terms and specific sovereignty and transparency obligations. These requirements apply no matter where the data is stored. Google’s certification, which covers both Google Cloud and Google Workspace, covers all following perimeters, referred to in the French Public Health Code and the HDS framework as “Activities”:
- The provision and maintenance in operational condition of physical sites for hosting the hardware infrastructure of the information system used to process the health data;
- The provision and maintenance in operational condition of the hardware infrastructure of the information system used to process the health data;
- The provision and maintenance in operational condition of the virtual infrastructure of the information system used to process the health data;
- The provision and maintenance in operational condition of the platform for hosting information system applications;
- The management and operation of the information system containing the health data.
Please note that the product offerings in scope for Activity 5 are limited compared to the other activities, as outlined below.
The scope of these product offerings has been aligned with the data location capabilities of each of the Google Cloud and Google Workspace products, which allow for storage of data at rest within the European Economic Area (EEA). Note that the scope of this HDS v2.0 certification is limited to enterprise customers.
Please note that Activity 6 is not included in the scope of Google’s HDS v2.0 certification, as there is no reliance on outsourced backups for the scope detailed below.
See the HDS FAQs section below for more information.
Google Cloud is listed on the ASIP’s website as an HDS-certified host, meaning that companies that work with and in the French healthcare industry and that comply with France's General Security Policy for Health Information Systems (PGSSI-S) can confidently exchange, store data, and run workloads pertaining to French PHI on Google Cloud and Google Workspace.
Enhanced and Premium Support customers, who are subject to HDS requirements, can submit a technical support case in French through the Google Cloud console.
Potential customers can reach out to sales for more information.
Products in scope (Activities 1 to 4)
Google Cloud Platform products in scope for Activities 1 to 4:
Google Workspace products in scope for Activities 1 to 4:
Products in scope (Activities 1 to 5)
Google Cloud Platform products in scope for Activities 1 to 5:
Google Workspace products in scope for Activities 1 to 5:
HDS FAQs
What is HDS v2.0?
HDS v2.0 is France's mandatory certification for health data security, confidentiality, and integrity, applicable to organizations hosting personal health information (PHI). The HDS v2.0 framework published in May 2024 replaces the prior HDS framework established in 2018.
What are the key changes in HDS v2.0?
HDS v2.0 brings several enhancements, most notably a reinforced focus on data sovereignty. Key changes include mandatory European Economic Area (EEA) data storage, enhanced transparency for international transfers, and alignment with ISO 27001:2022 for a robust Information Security Management System.
Is Google Cloud HDS v2.0 certified?
Yes, Google Cloud successfully transitioned from HDS to HDS v2.0 in July 2025. This achievement makes us one of the first hyperscale cloud providers to be HDS v2.0 certified, a clear reflection of our dedication to providing a platform built on the highest principles of trust, security, and compliance.
Where do I find the certificates?
You can find the Google certificates here:
They are also made available in the Quick links section, at the top of the webpage.
What information is on the certificates?
Our certificate sets out the issuance and renewal dates of the certification, the covered Activities and products in scope for the Activities.
What about EEA data storage?
HDS v2.0 introduces new sovereignty requirements to provide stronger guarantees for data protection, most notably requiring personal health data to be stored exclusively within the EEA.
Our certificates scope has been aligned with the capability of Google Cloud and Google Workspace to store data within the EEA. Customers should be mindful that, as part of this, only certain products are certified to store personal health information within the EEA. Please refer to the ‘Products in scope’ sections of the webpage to see which products offer this certification. These sections list all the products in scope for the Activities (based on the original lists found in the certificates). Customers should also bear in mind that, for the products listed, they will need to select a specific Region or Multi-Region as detailed in the Cloud Locations Page.
Specific details on data processing locations and Google Cloud's obligations regarding data localisation including in relation to regional legal and regulatory requirements, can be found in the Cloud Data Processing Addendum and the applicable Service Specific Terms.
Where do I find the Representation of Guarantees?
HDS v2.0 standardizes a Representation of Guarantees table, setting out additional required information pertaining to hosted PHI.
You can find the Google Representation of Guarantees table here:
It is also made available in the Quick links section, at the top of the webpage.
Where do I find information on ISO 27001:2022?
HDS v2.0 incorporates the latest evolutions of the international ISO 27001 standard, ensuring that the certification is not only aligned with French regulations but also with global cybersecurity best practices.
For a comprehensive overview of our security and data protection measures, including our organizational and technical controls, please visit the Google Security pages.
Ready to leverage HDS v2.0?
Google Cloud is committed to supporting our customers who are subject to the French Public Health Code rules for the security and protection of PHI.
It is important to note that complying with these rules is a shared responsibility between the customer and Google. Specifically, while Google Cloud provides a secure infrastructure for the storage and processing of PHI, the customer is responsible for ensuring that the environment and applications that they build on top of Google Cloud are properly configured and secured according to their compliance obligations. One of the key responsibilities for a customer is to determine whether or not they require EEA storage. As outlined above, Google Cloud offers EEA storage options, but it is up to customers to select the appropriate Region or Multi-Region for their workloads.
Additionally, mandatory contract terms must be included in the contract for the hosting of personal health data by Google Cloud (host) on behalf of a healthcare provider, life sciences organization, or software vendor (customer). Google Cloud offers contract terms for Google Cloud and Google Workspace to address these requirements, but ultimately customers are responsible for evaluating their own compliance.
The contract terms include a HDS addendum that customers can accept via their Google Cloud console, if they determine they require such contract terms with Google Cloud for the purposes of their compliance.
Please contact your Google Cloud Representative for further details.
Take the next step
Start building on Google Cloud with $300 in free credits and 20+ always free products.
Learn security best practices
See our best practicesSolve common problems
Watch security use-case videosWork with a partner
See our security partners
