HDS v2.0 is France's mandatory certification for health data security, confidentiality, and integrity, applicable to organizations hosting personal health information (PHI). The HDS v2.0 framework published in May 2024 replaces the prior HDS framework established in 2018.

HDS v2.0 brings several enhancements, most notably a reinforced focus on data sovereignty. Key changes include mandatory European Economic Area (EEA) data storage, enhanced transparency for international transfers, and alignment with ISO 27001:2022 for a robust Information Security Management System.

Yes, Google Cloud successfully transitioned from HDS to HDS v2.0 in July 2025. This achievement makes us one of the first hyperscale cloud providers to be HDS v2.0 certified, a clear reflection of our dedication to providing a platform built on the highest principles of trust, security, and compliance.

You can find the Google certificates here: 

• Google Cloud HDS v2.0 certificate
• Google Workspace HDS v2.0 certificate

They are also made available in the Quick links section, at the top of the webpage.

Our certificate sets out the issuance and renewal dates of the certification, the covered Activities and products in scope for the Activities.

HDS v2.0 introduces new sovereignty requirements to provide stronger guarantees for data protection, most notably requiring personal health data to be stored exclusively within the EEA. 

Our certificates scope has been aligned with the capability of Google Cloud and Google Workspace to store data within the EEA. Customers should be mindful that, as part of this, only certain products are certified to store personal health information at rest within the EEA. Please refer to the ‘Products in scope’ sections of the webpage to see which products offer this certification. These sections list all the products in scope for the Activities (based on the original lists found in the certificates) and, for the products listed, the specific locations that are in scope (as detailed in the certificates). Further information on the locations of data storage facilities used by Google is provided on the Cloud Locations Page and the details of applicable features for some products can be found on the Google Cloud Data Residency Page. Customers are advised to review these to ensure they appropriately configure the products they are using (e.g. by selecting EEA data storage where needed).

Specific details on data processing locations and Google Cloud's obligations regarding data localisation including in relation to regional legal and regulatory requirements, can be found in the Cloud Data Processing Addendum and the applicable Service Specific Terms.

HDS v2.0 standardizes a Representation of Guarantees table, setting out additional required information pertaining to hosted PHI.

You can find the Google Representation of Guarantees table here: 

• Representation of Guarantees

It is also made available in the Quick links section, at the top of the webpage.

HDS v2.0 incorporates the latest evolutions of the international ISO 27001 standard, ensuring that the certification is not only aligned with French regulations but also with global cybersecurity best practices. 

For a comprehensive overview of our security and data protection measures, including our organizational and technical controls, please visit the Google Security pages.

Google Cloud is committed to supporting our customers who are subject to the French Public Health Code rules for the security and protection of PHI.

It is important to note that complying with these rules is a shared responsibility between the customer and Google. Specifically, while Google Cloud provides a secure infrastructure for the storage and processing of PHI, the customer is responsible for ensuring that the environment and applications that they build on top of Google Cloud are properly configured and secured according to their compliance obligations. One of the key responsibilities for a customer is to determine whether or not they require EEA storage. As outlined above, Google Cloud offers EEA storage options, but it is up to customers to ensure they appropriately configure the products they are using (e.g. by selecting EEA data storage where needed). 

Additionally, mandatory contract terms must be included in the contract for the hosting of personal health data by Google Cloud (host) on behalf of a healthcare provider, life sciences organization, or software vendor (customer). Google Cloud offers contract terms for Google Cloud and Google Workspace to address these requirements, including a HDS addendum. Customers are responsible for determining if they require such contract terms with Google Cloud for the purposes of their compliance.

Please speak to your Google Cloud sales contact for further details.