[wsy]

In EU, you need to write something like "...share data with third-party service providers..." already if you use AWS, because customer data will not only be held at your premises, but also held by another company (Amazon).

It seems to be difficult to phrase the Privacy Policy in a way that will satisfy this condition, and at the same time remove the 'wiggle room' you see.

[dsacco]

Call out the third party service providers explicitly.

[wsy]

That has the big disadvantage that if you switch from AWS to Google Cloud, you need to notify all of your customers about the changed policy and ask them for consent again. I have not seen any Privacy Policy yet which lists the service providers.

[dsacco]

You don't need to ask for consent, because it's typical that a clause will simply state, "Continued use of this service indicates acceptance of these terms", etc. That seems like a non-problem as far as these things go.

The reason you don't see privacy policies which list that information is not because it has an exorbitant inconvenience cost, it's because they benefit directly from that information asymmetry.

[wsy]

You actually do, because now you want to send data to Google Inc., for which you don't have the consent of your customers yet. They only agreed to sending it to Amazon. You can't make them agree to any future changes of your Privacy Policy.

edit: yes, you can send out a notification on every change and tell your customers that it is an implicit consent if they don't object. But I still wouldn't want to do that for every change of service provider, and there can be quite a few such providers in an SaaS.