Remember, two key considerations when doing key management
1) Do not save it alongside data
2) Do not let cloud service provider manage the keys

Under GDPR. it is mandatory to notify consumers how their data will be used

The key techniques to create a cloud are abstraction and orchestration. We abstract the resources from the underlying physical infrastructure to create our pools, and use orchestration(and automation)to coordinate carving out and delivering a set of resources from the pools to the consumers. As you will see, these two techniques create all the essential characteristics we use to define something as a
"cloud."
Ref: CSA Security Guidelines V4.0

Following are the risk mitigation strategies