If information security is implemented incorrectly or inadequately, organisations may be in breach of statutory regulations or contractual agreements. Organisations must also comply with many different industry-specific, national, and international legal frameworks. As this can be very complex, users can unintentionally violate legal requirements or even knowingly accept this risk. For example, many cloud service providers offer their services in an international environment. These providers are thus often subject to the laws of different countries. Cloud users, however, often focus solely on low costs and make incorrect assumptions about legal framework conditions that should be taken into account with regard to data protection, information requirements, insolvency law, liability, or information access for third parties.