About three years after the GDPR came into force, the European Data Protection Board (EDPB) formalizes the first code of conduct on Cloud services.