Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28.
Your storage provider such as Azure and AWS cannot decrypt this data, so it would not be personal data if processed by them for their own purposes. There is an argument that they did not receive personal data, especially considering the definition of a recipient in Art 4: a person/entity “to which the personal data are disclosed”.
However, this is not necessarily relevant when talking about sub-processors. A processor is anyone who “processes personal data on behalf of the controller”. As processors, they're not using the data for their own purposes but are just acting on your behalf. Storage is a kind processing, and they are storing data on your behalf. This data is personal data for you. Thus, I'd consider the storage providers to be your processors.
Due to your use of strong client-side encryption, your remaining compliance obligations are mostly boilerplate (signing a data processing agreement per Art 28, sorting out international transfers if necessary, and getting agreement for adding a sub-processor from your controllers). Note that encryption is mandatory whenever appropriate (Art 32(1)(a)).
Such client-side encryption could even serve as a legal basis for storing the data in jurisdictions that don't offer an adequate level of data protection, such as a data center in the US. Per the draft EDPB recommendations on measures that supplement transfers tools (published as a response to Schrems II / the invalidation of Privacy Shield):
Use Case 1: Data storage for backup and other purposes that do not require access to data in the clear
79. A data exporter uses a hosting service provider in a third country to store personal data, e.g., for backup purposes.
If
- the personal data is processed using strong encryption before transmission,
- the encryption algorithm and its parameterization (e.g.,key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities in the recipient country taking into account the resources and technical capabilities (e.g.,computing power for brute-force attacks) available to them,
- the strength of the encryption takes into account the specific time period during which the confidentiality of the encrypted personal data must be preserved,
- the encryption algorithm is flawlessly implemented by properly maintained software the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification,
- the keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of an intended recipient, and revoked), and
6.the keys are retained solely under the control of the data exporter, or other entities entrusted with this task which reside in the EEA or a third country, territory or one or more specified sectors within a third country, or at an international organisation for which the Commission has established in accordance with Article 45 GDPR that an adequate level of protectionis ensured,
then the EDPB considers that the encryption performed provides an effective supplementary measure.
