In addition to preserving primary customer data, legal experts advise cloud providers to protect secondary information such as

Datacenter visitor logs are operational security records, not secondary information specifically associated with customer data that legal experts designate for customer data protection.

Third-party contracts are business agreements between the provider and vendors, not secondary data tied to individual customer datasets.

Operating system configuration scripts are infrastructure management assets, not data-associated secondary information relevant to customer data protection.

Regulatory databases are reference materials used by the provider internally, not secondary information generated from or associated with customer data.

Metadata - such as file timestamps, access logs, geolocation tags, and data ownership identifiers - is secondary information that can expose sensitive details about how and when primary data was created, accessed, or transmitted. Legal experts flag metadata as requiring protection because its disclosure can constitute a privacy breach or enable inference attacks against the primary data.