Under EU law, a cloud customer who gives sensitive data to a cloud provider is still legally responsible for the damages resulting from a data breach caused by the provider; the EU would say that it…

Proof refers to evidence or argument establishing a fact, not the prior investigation process.

Evidence refers to information used to prove a point, which is distinct from the proactive investigation of due diligence.

Due diligence refers to the reasonable steps an organization must take to investigate and understand the risks associated with a decision or relationship, such as selecting a cloud provider. Under EU law (like GDPR), a data controller (customer) is legally responsible for ensuring that any data processor (provider) offers sufficient guarantees regarding security, meaning the customer must perform adequate due diligence to avoid liability for breaches caused by poor provider selection.

Application of reasonableness is a general legal standard but does not specifically refer to the investigative process required before making a decision, as 'due diligence' does.